Examkin

Question

Difficulty: MediumAzure Policy Governance

An organization named Litware, Inc. has an Azure environment structured with a management group hierarchy. The hierarchy includes a parent management group named TenantRoot, with two child management groups named Production-MG and Development-MG.

The security compliance team mandates the following requirements:
* All virtual machines deployed within Production-MG must have the Azure Monitor Agent installed automatically.
* Any attempt to deploy a storage account within Production-MG that does not enforce secure transit (HTTPS) must be blocked at deployment.
* Development-MG must not be subjected to these compliance rules.

You need to design an Azure Policy solution to meet these requirements with the least amount of administrative overhead.

Which two configurations should you recommend? (Select two.)

  1. Assign a policy initiative to the Production-MG management group containing a policy definition with the DeployIfNotExists effect to deploy the Azure Monitor Agent.Answer
  2. Include a policy definition with the Deny effect in the policy initiative to block the creation of storage accounts without secure transit enabled.Answer
  3. C
    Include a policy definition with the Audit effect in the policy initiative to flag virtual machines without the Azure Monitor Agent, and manually trigger a monthly remediation task.
  4. D
    Include a policy definition with the Modify effect in the policy initiative to prevent the creation of storage accounts that do not enforce secure transit.

Answer

Assign a policy initiative with the DeployIfNotExists effect to Production-MG and include a policy definition with the Deny effect in the initiative.
To meet the compliance requirements with minimum administrative overhead, we assign a policy initiative containing the required policy definitions directly to the Production-MG management group. The requirement to automatically deploy the Azure Monitor Agent is best met using the DeployIfNotExists effect, which deploys the agent extension if it is missing. The requirement to block storage accounts without secure transit enabled is met using the Deny effect, which rejects the deployment request if compliance conditions are not met.

Step-by-Step Solution

1
Determine the appropriate policy assignment scope and grouping.
Create a policy initiative and assign it directly to Production-MG. This avoids assigning to the TenantRoot with exclusions (notScopes), reducing administrative overhead.
Assigning at the closest shared scope containing only production resources avoids unnecessary policy evaluations and exclusion management.
2
Select the policy effect for the Azure Monitor Agent requirement.
Use the DeployIfNotExists (DINE) effect to install the Azure Monitor Agent.
DeployIfNotExists automatically deploys the template for the Azure Monitor Agent if the virtual machine is deployed without it, fulfilling the automatic installation requirement.
3
Select the policy effect for the secure transit requirement.
Use the Deny effect to block storage accounts without secure transfer enabled.
The Deny effect prevents the resource creation request from succeeding if the resource fails validation, enforcing immediate compliance before deployment.

Key Concept

Azure Policy effects (DeployIfNotExists, Deny) and assignment scopes to govern resource compliance with minimal administrative overhead.
Rate this question

Topics

Azure Policy Governance

More questions from this topic