Examkin

Soru

Zorluk: OrtaAzure Policy Governance

Zenith Retail Systems is designing a governance strategy for its Azure subscriptions. The security team requires that all virtual machines deployed to a resource group named 'PCI-DSS-Production' are automatically registered with Azure Backup. If a virtual machine is created without a backup configuration, the system must automatically configure the backup protection and deploy the required recovery services resources without preventing the virtual machine from being created. Which Azure Policy effect should you recommend to meet this requirement?

  1. DeployIfNotExistsCevap
  2. B
    Deny
  3. C
    AuditIfNotExists
  4. D
    Modify

Cevap

DeployIfNotExists
The DeployIfNotExists effect is the correct choice because it evaluates the resource configuration and automatically executes a template deployment (in this case, establishing the backup configuration) when the target resource is created, without blocking the resource creation itself.

Adım Adım Çözüm

1
Analyze the business and technical requirements.
The requirements dictate that resources must be automatically remediated (configured with Azure Backup) during deployment, and the deployment of the parent virtual machine must not be blocked.
This helps rule out auditing-only effects and blocking effects.
2
Evaluate the capabilities of Azure Policy effects.
The DeployIfNotExists effect allows the deployment of a nested template when a specific condition is met (e.g., when a VM is deployed but the backup configuration does not exist). The Deny effect blocks creation, and the AuditIfNotExists effect only audits compliance.
Choosing the correct policy effect depends on understanding whether the policy should block, audit, or deploy a remediation resource.
3
Compare DeployIfNotExists and Modify for resource remediation.
Modify is restricted to changing properties and tags on the target resource. Since enabling Azure Backup requires creating a separate backup item resource associated with a Recovery Services vault, a deployment operation is required, making DeployIfNotExists the correct choice.
This ensures the selected option has the technical capability to deploy the required child resources.

Anahtar Kavram

Azure Policy effects for automated remediation of resources
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru