Examkin

Question

Difficulty: MediumAzure Policy Governance

FinSecure Corp has multiple subscriptions organized under a single Azure tenant. The compliance team mandates that all Azure Key Vaults must have diagnostic settings configured to route audit logs to a central Log Analytics workspace. Developer teams frequently deploy new Key Vaults using infrastructure as code (IaC) templates that often omit the diagnostic settings. The proposed governance solution must ensure that diagnostic settings are configured automatically upon vault creation, must not block developer deployments, and must minimize administrative overhead. Which of the following governance strategies should you recommend?

  1. Assign an Azure Policy initiative containing a policy definition with the DeployIfNotExists effect at the management group level to automatically deploy diagnostic settings for Key Vaults.Answer
  2. B
    Assign an Azure Policy definition with the Deny effect at the management group level to prevent the creation of any Key Vault that lacks diagnostic settings in its deployment template.
  3. C
    Assign an Azure Policy definition with the Audit effect at the management group level to flag non-compliant Key Vaults, and configure a weekly Azure Automation runbook to deploy the missing diagnostic settings.
  4. D
    Assign an Azure Policy definition with the AuditIfNotExists effect at the management group level, and grant developers the Monitoring Contributor RBAC role directly on the subscriptions to manually remediate non-compliant vaults.

Answer

Assign an Azure Policy initiative containing a policy definition with the DeployIfNotExists effect at the management group level to automatically deploy diagnostic settings for Key Vaults.
The correct strategy uses the DeployIfNotExists policy effect assigned at the management group level. This effect checks for the existence of a child resource (in this case, diagnostic settings) when a parent resource (Key Vault) is created. If the child resource does not exist, Azure Policy deploys it using a template. This remediates the resource automatically in real-time, does not block the initial deployment, and minimizes administrative overhead through inheritance.

Step-by-Step Solution

1
Analyze the requirement to configure a dependent resource (diagnostic settings) automatically upon parent resource (Key Vault) creation.
Identify that the DeployIfNotExists policy effect is designed to deploy templates and remediate non-compliance automatically when a resource is created or updated.
This meets the primary automated configuration objective.
2
Evaluate the requirement that the solution must not block developer deployments.
Rule out Deny policies, as they prevent the creation of resources and block deployments.
Ensuring uninterrupted developer workflows is a core constraint.
3
Select the scope and policy structure that minimizes administrative overhead across multiple subscriptions.
Determine that assigning a policy initiative at the management group level ensures inheritance across all subscriptions without direct per-subscription assignment.
This establishes centralized governance at scale.

Key Concept

Azure Policy Governance
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy Governance

More questions from this topic