An organization is designing a governance strategy for an Azure environment consisting of a root management group and several production subscriptions. You need to implement Azure Policy definitions to enforce compliance for the following requirements:
- All newly deployed Azure storage accounts must have shared key access disabled. If a deployment template attempts to create a storage account with shared key access enabled, the deployment must be blocked.
- All virtual machines must be automatically configured with backup protection. If a virtual machine is deployed without a backup configuration, the policy must deploy the required resources and configure the backup.
Which two policy effects should you recommend to meet these requirements?
- The Deny effect to block the deployment of storage accounts with shared key access enabledCevap
- The DeployIfNotExists effect to configure backup protection for virtual machinesCevap
- CThe Modify effect to block the deployment of storage accounts with shared key access enabled
- DThe AuditIfNotExists effect to configure backup protection for virtual machines
Cevap
Recommend the Deny effect to block the deployment of storage accounts with shared key access enabled, and recommend the DeployIfNotExists effect to configure backup protection for virtual machines.
To block resource creation that fails to comply with the disabled shared key setting, the Deny effect must be used. To automatically deploy backup configurations (which represent related/secondary resources) when a virtual machine is created, the DeployIfNotExists effect is required since it triggers a template deployment to remediate non-compliance.
Adım Adım Çözüm
Anahtar Kavram
Azure Policy effects mapping to blocking and automatic remediation scenarios
Tahmini Süre:1m 30s