Examkin

Soru

Zorluk: OrtaAzure Policy Governance

FinSecure Corp has multiple subscriptions organized under a single Azure tenant. The compliance team mandates that all Azure Key Vaults must have diagnostic settings configured to route audit logs to a central Log Analytics workspace. Developer teams frequently deploy new Key Vaults using infrastructure as code (IaC) templates that often omit the diagnostic settings. The proposed governance solution must ensure that diagnostic settings are configured automatically upon vault creation, must not block developer deployments, and must minimize administrative overhead. Which of the following governance strategies should you recommend?

  1. Assign an Azure Policy initiative containing a policy definition with the DeployIfNotExists effect at the management group level to automatically deploy diagnostic settings for Key Vaults.Cevap
  2. B
    Assign an Azure Policy definition with the Deny effect at the management group level to prevent the creation of any Key Vault that lacks diagnostic settings in its deployment template.
  3. C
    Assign an Azure Policy definition with the Audit effect at the management group level to flag non-compliant Key Vaults, and configure a weekly Azure Automation runbook to deploy the missing diagnostic settings.
  4. D
    Assign an Azure Policy definition with the AuditIfNotExists effect at the management group level, and grant developers the Monitoring Contributor RBAC role directly on the subscriptions to manually remediate non-compliant vaults.

Cevap

Assign an Azure Policy initiative containing a policy definition with the DeployIfNotExists effect at the management group level to automatically deploy diagnostic settings for Key Vaults.
The correct strategy uses the DeployIfNotExists policy effect assigned at the management group level. This effect checks for the existence of a child resource (in this case, diagnostic settings) when a parent resource (Key Vault) is created. If the child resource does not exist, Azure Policy deploys it using a template. This remediates the resource automatically in real-time, does not block the initial deployment, and minimizes administrative overhead through inheritance.

Adım Adım Çözüm

1
Analyze the requirement to configure a dependent resource (diagnostic settings) automatically upon parent resource (Key Vault) creation.
Identify that the DeployIfNotExists policy effect is designed to deploy templates and remediate non-compliance automatically when a resource is created or updated.
This meets the primary automated configuration objective.
2
Evaluate the requirement that the solution must not block developer deployments.
Rule out Deny policies, as they prevent the creation of resources and block deployments.
Ensuring uninterrupted developer workflows is a core constraint.
3
Select the scope and policy structure that minimizes administrative overhead across multiple subscriptions.
Determine that assigning a policy initiative at the management group level ensures inheritance across all subscriptions without direct per-subscription assignment.
This establishes centralized governance at scale.

Anahtar Kavram

Azure Policy Governance
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru