Examkin

Question

Difficulty: MediumAzure Policy Governance

An organization manages its cloud resources using an Azure Management Group hierarchy. A management group named CoreServices-MG contains subscriptions used for shared network infrastructure. The security team mandates that all virtual networks deployed within CoreServices-MG must have diagnostic settings configured to send traffic metrics to a central Log Analytics workspace. The deployment of virtual networks must proceed without interruption even if the diagnostic settings are not defined during creation, but the diagnostic settings must be automatically configured immediately after deployment. Which Azure Policy effect should you specify in the policy definition to meet these requirements?

  1. A
    Deny
  2. B
    Modify
  3. DeployIfNotExistsAnswer
  4. D
    Audit

Answer

DeployIfNotExists
The DeployIfNotExists effect is the correct choice because it evaluates a resource during creation or update, and if the resource does not have the specified sub-resource (in this case, diagnostic settings), it automatically deploys the template to create it. This ensures compliance without blocking the deployment of the parent resource.

Step-by-Step Solution

1
Analyze the business requirements for resource deployment and remediation.
The solution requires that virtual network deployment must not be blocked (meaning Deny cannot be used), but the diagnostic settings must be configured automatically (meaning Audit cannot be used alone).
Understanding the constraints is necessary to narrow down the correct policy effect.
2
Compare the capabilities of Modify and DeployIfNotExists for configuring child/extension resources.
Modify is restricted to changing properties and tags on the target resource itself. Diagnostic settings are extension resources, which require DeployIfNotExists to deploy the template.
Distinguishing between resource property modification and secondary resource deployment ensures correct governance design.
3
Select the policy effect that deploys resources asynchronously.
DeployIfNotExists is chosen because it triggers a template deployment if the specified condition (missing diagnostic settings) is met, following successful creation of the parent resource.
DeployIfNotExists meets all criteria of automatic remediation without blocking the initial deployment.

Key Concept

Azure Policy effects determine the action taken when compliance rules are evaluated. DeployIfNotExists is used for automated remediation of missing child or extension resources without blocking parent deployments.
Estimated Time:1m 30s
Rate this question

Topics

Azure Policy Governance

More questions from this topic