Examkin

Soru

Zorluk: OrtaAzure Policy Governance

A company named AeroSpace Dynamics is designing a governance strategy for its Azure environment. The environment consists of multiple subscriptions under a single management group.

You must enforce the following compliance requirements:
1. All resource groups must have an Owner tag. If a resource group is created without this tag, the tag must be automatically added and set to a default value during resource group creation.
2. All Azure SQL databases must have vulnerability assessment configured. If a database is deployed without it, the vulnerability assessment settings must be deployed automatically.

You need to recommend the Azure Policy effects that will satisfy these requirements without blocking resource creation.

Which two policy effects should you recommend? (Select two.)

  1. ModifyCevap
  2. DeployIfNotExistsCevap
  3. C
    Deny
  4. D
    AuditIfNotExists

Cevap

The correct policy effects are Modify and DeployIfNotExists.
The Modify effect should be recommended to automatically add or update resource tags during creation or update. The DeployIfNotExists effect should be recommended to automatically deploy the vulnerability assessment resource template when a SQL database is created without it. Both effects satisfy the requirements without blocking resource creation.

Adım Adım Çözüm

1
Analyze the first requirement: automatically adding an Owner tag to a resource group if it is missing during creation without blocking the deployment.
The Modify policy effect is ideal for adding, updating, or removing properties or tags during resource creation or update.
Unlike Deny, Modify corrects the resource at creation time without failing the deployment.
2
Analyze the second requirement: automatically deploying vulnerability assessment settings for Azure SQL databases if they are missing.
The DeployIfNotExists (DINE) policy effect is designed to deploy a template containing a child or related resource when the target resource is created or updated and does not have the specified configuration.
Using DINE ensures automatic remediation of the database configuration without blocking the initial deployment.

Anahtar Kavram

Selecting the correct Azure Policy effect (Modify vs. DeployIfNotExists vs. Deny/Audit) based on remediation and deployment blocking requirements.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru