Soru

Zorluk: OrtaAzure Policy Governance

NovaSpire Logistics is designing an Azure governance solution. The compliance team outlines the following security requirements:
1. All Azure virtual machines must automatically have the Azure Monitor Agent installed upon deployment without manual intervention.
2. Any attempt to deploy an Azure Storage Account that does not enforce secure transit (HTTPS) must be blocked immediately.

Which two Azure Policy effects should you recommend to implement these requirements?

  1. DeployIfNotExists to remediate virtual machines that do not have the Azure Monitor Agent installedCevap
  2. Deny to block the deployment of storage accounts that do not require HTTPSCevap
  3. C
    Modify to alter the configuration of virtual machines and install the Azure Monitor Agent
  4. D
    Audit to flag storage accounts that are deployed without secure transfer enabled

Cevap

DeployIfNotExists to remediate virtual machines that do not have the Azure Monitor Agent installed, and Deny to block the deployment of storage accounts that do not require HTTPS.
DeployIfNotExists allows automatic remediation by deploying the Azure Monitor Agent extension if the virtual machine does not have it, which meets the requirement of installing the agent without manual intervention. Deny evaluates the storage account deployment request and immediately blocks the creation if secure transit is not enforced, fulfilling the second requirement.

Adım Adım Çözüm

1
Analyze the first requirement which requires the automatic installation of the Azure Monitor Agent.
This requires deploying a VM extension resource when the primary VM resource is created.
Since the requirement demands deploying a nested resource (extension) if it is missing, DeployIfNotExists is the appropriate effect.
2
Analyze the second requirement which demands blocking storage accounts that do not enforce secure transit.
This requires preventing the creation of the resource entirely if it fails validation.
The Deny effect is designed to block requests that match the policy rules, fulfilling the blocking requirement.

Anahtar Kavram

Azure Policy effects validation and remediation strategies
Tahmini Süre:1m 30s
Bu soruyu puanla