NovaSpire Logistics is designing an Azure governance solution. The compliance team outlines the following security requirements:
1. All Azure virtual machines must automatically have the Azure Monitor Agent installed upon deployment without manual intervention.
2. Any attempt to deploy an Azure Storage Account that does not enforce secure transit (HTTPS) must be blocked immediately.
Which two Azure Policy effects should you recommend to implement these requirements?
- DeployIfNotExists to remediate virtual machines that do not have the Azure Monitor Agent installedCevap
- Deny to block the deployment of storage accounts that do not require HTTPSCevap
- CModify to alter the configuration of virtual machines and install the Azure Monitor Agent
- DAudit to flag storage accounts that are deployed without secure transfer enabled
Cevap
DeployIfNotExists to remediate virtual machines that do not have the Azure Monitor Agent installed, and Deny to block the deployment of storage accounts that do not require HTTPS.
DeployIfNotExists allows automatic remediation by deploying the Azure Monitor Agent extension if the virtual machine does not have it, which meets the requirement of installing the agent without manual intervention. Deny evaluates the storage account deployment request and immediately blocks the creation if secure transit is not enforced, fulfilling the second requirement.
Adım Adım Çözüm
Anahtar Kavram
Azure Policy effects validation and remediation strategies
Tahmini Süre:1m 30s