An organization is designing a governance strategy for its Azure subscriptions. The strategy must satisfy the following compliance requirements:
- Automatically deploy a diagnostic setting to any newly created Azure Key Vault if it is missing, without blocking the creation of the Key Vault itself.
- Block the creation of virtual networks that do not comply with corporate IP address space allocations.
Which of the following Azure Policy effects should you include in the design? (Select TWO.)
- DeployIfNotExists for the Key Vault diagnostic settings requirementAnswer
- Deny for the non-compliant virtual networks requirementAnswer
- CDeny for the Key Vault diagnostic settings requirement
- DAudit for the non-compliant virtual networks requirement
Answer
DeployIfNotExists for the Key Vault diagnostic settings requirement, and Deny for the non-compliant virtual networks requirement
The correct options are DeployIfNotExists for the Key Vault diagnostic settings requirement, and Deny for the non-compliant virtual networks requirement. DeployIfNotExists allows the parent resource (Key Vault) to be created, and then automatically deploys the missing child resource (diagnostic setting) to satisfy compliance. Deny enforces compliance actively by blocking the creation of virtual networks that violate the IP allocation rules.
Step-by-Step Solution
Key Concept
Azure Policy Effects Selection