Examkin

Soru

Zorluk: OrtaAzure Policy Governance

Veridian Finance is designing a governance and security strategy for its Azure environment. The security team establishes the following compliance mandates for all Azure Key Vault instances:

1. Every Key Vault must have diagnostic logs enabled. If a Key Vault is deployed without diagnostic logs, a Diagnostic Setting must be automatically created to forward the logs to a central Log Analytics workspace.
2. Every Key Vault must have public network access disabled. Any deployment attempt of a Key Vault with public network access enabled must be blocked.

You need to select the Azure Policy effects that meet these compliance mandates while minimizing administrative overhead.

Which policy effects should you recommend?

  1. DeployIfNotExists for the diagnostic logs, and Deny for the public network accessCevap
  2. B
    Modify for the diagnostic logs, and Deny for the public network access
  3. C
    Deny for the diagnostic logs, and Audit for the public network access
  4. D
    DeployIfNotExists for the diagnostic logs, and Audit for the public network access

Cevap

DeployIfNotExists for the diagnostic logs, and Deny for the public network access
The DeployIfNotExists effect is required to automatically deploy a diagnostic setting (which is a child resource) when a Key Vault is created without one. The Deny effect blocks the creation or update of resources that do not comply with the specified rules, which matches the requirement to prevent Key Vaults from being deployed with public network access enabled.

Adım Adım Çözüm

1
Analyze the automatic log enablement requirement to determine the correct policy effect.
Creating diagnostic logs involves deploying a separate child resource (Microsoft.Insights/diagnosticSettings). In Azure Policy, deploying templates to remediate or create child resources requires the DeployIfNotExists effect.
The DeployIfNotExists effect evaluates the compliance of the parent resource and executes an ARM template deployment to create the missing child resource.
2
Analyze the requirement to prevent deployment of Key Vaults with public network access.
The requirement specifies that any deployment attempt violating this rule must be blocked. The Deny effect is the standard Azure Policy effect used to block non-compliant requests before creation.
This is necessary because the Deny effect is evaluated during the Azure Resource Manager validation phase and prevents the resource creation or update if the rule evaluation evaluates to true.

Anahtar Kavram

Azure Policy effects are chosen based on the desired behavior: blocking non-compliant changes (Deny) or automatically deploying resources/settings when they are missing (DeployIfNotExists).
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru