Examkin

Soru

Zorluk: OrtaAzure Policy Governance

An enterprise is designing an Azure governance solution. The security team mandates that all Azure Key Vaults in the production subscriptions must have diagnostic settings configured to send logs to a central Log Analytics workspace. The solution must ensure that when developers create new Key Vaults, the diagnostic settings are automatically created if they are missing, without preventing the creation of the Key Vaults. Which Azure Policy effect should you recommend in the policy design to meet these requirements?

  1. DeployIfNotExistsCevap
  2. B
    Modify
  3. C
    Deny
  4. D
    Audit

Cevap

DeployIfNotExists
The DeployIfNotExists effect is the correct choice because diagnostic settings are distinct child resources (Microsoft.Insights/diagnosticSettings) associated with the Key Vault. DeployIfNotExists enables Azure Policy to automatically deploy these missing child resources without preventing developers from creating the Key Vaults.

Adım Adım Çözüm

1
Analyze the target resource and governance requirement.
Diagnostic settings are child resources of the Key Vault (type Microsoft.Insights/diagnosticSettings) rather than properties on the Key Vault resource itself.
This helps distinguish between effects that alter resource properties (like Modify) and effects that deploy child resources.
2
Evaluate the deployment constraints.
The requirement states that the policy must not prevent the creation of Key Vaults.
This rules out the Deny effect, which would block the deployment of any non-compliant Key Vault.
3
Select the correct effect that performs remediation for child resources.
DeployIfNotExists checks for the existence of the child resource and automatically deploys it using a template if it is missing, while allowing the parent resource deployment to succeed.
Only DeployIfNotExists supports the automatic deployment of dependent child resources like diagnostic settings without blocking the primary resource creation.

Anahtar Kavram

Azure Policy effects dictate what action Azure takes when a resource is evaluated. DeployIfNotExists is used to remediate non-compliant resources by deploying nested or child resources, whereas Modify alters properties on the resource itself.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru