Examkin

Question

Difficulty: EasyAzure Policy Governance

Your company requires that all virtual machines deployed to a subscription automatically have the Log Analytics agent installed to ensure monitoring compliance. If a virtual machine is deployed without the agent, the agent must be automatically installed without blocking the deployment of the virtual machine itself. Which Azure Policy effect should you recommend to meet this requirement?

  1. DeployIfNotExistsAnswer
  2. B
    Deny
  3. C
    Audit
  4. D
    Modify

Answer

DeployIfNotExists
The DeployIfNotExists effect checks if a related or child resource (such as a virtual machine extension) exists, and if not, it automatically triggers a deployment template to remediate the compliance gap. This allows the primary resource (the virtual machine) to be deployed successfully while automatically ensuring that the required extension is installed.

Step-by-Step Solution

1
Analyze the business requirement
The virtual machine deployment must not be blocked, but the missing Log Analytics agent must be automatically installed (remediated) when the virtual machine is created.
This establishes that we need a policy effect that can perform remediation (resource deployment) dynamically.
2
Evaluate the policy effects based on compliance action
The 'DeployIfNotExists' effect checks for the specified child resource (the agent extension) and executes an ARM template deployment to install it if it is missing, matching the requirement.
Choosing the correct effect ensures the design meets the goal with minimal administrative overhead.

Key Concept

Azure Policy effects determine what happens when a resource matches a policy definition during creation or update. The DeployIfNotExists effect enables automated deployment of dependent resources or extensions when they are missing, ensuring automated compliance without blocking the deployment of the primary resource.
Estimated Time:1m 0s
Rate this question

Topics

Azure Policy Governance

More questions from this topic