Examkin

Soru

Zorluk: OrtaAzure Policy Governance

An enterprise is designing a governance strategy for its Azure subscriptions. The security team requires that all newly created Azure Storage accounts must have their minimum TLS version configured to version 1.2. If a deployment request does not specify this version or sets it to a lower value, the configuration must be automatically updated to version 1.2 without blocking the deployment of the resource. Which Azure Policy configuration should you recommend to meet these requirements with the least administrative overhead?

  1. A
    An Azure Policy using the Deny effect to block the deployment of any storage account that does not specify a minimum TLS version of 1.2.
  2. An Azure Policy using the Modify effect to set the minimum TLS version property to 1.2 during resource creation.Cevap
  3. C
    An Azure Policy using the DeployIfNotExists effect to run a template deployment that updates the minimum TLS version.
  4. D
    An Azure Policy using the Audit effect paired with a scheduled Azure Automation runbook to identify and update non-compliant storage accounts.

Cevap

An Azure Policy using the Modify effect to set the minimum TLS version property to 1.2 during resource creation.
The correct solution is to use the Modify effect. The Modify effect is used to add, replace, or remove properties or tags on a resource during creation or update. It allows the resource deployment to succeed while automatically correcting the minimum TLS version to 1.2, meeting the requirements with the least administrative overhead.

Adım Adım Çözüm

1
Analyze the governance requirement and target setting.
The requirement is to ensure the minimum TLS version on new storage accounts is set to 1.2, which is a resource property ('properties.minimumTlsVersion').
Understanding whether the target is a property of the resource itself or an auxiliary resource determines the correct policy effect.
2
Evaluate the remediation behavior.
The setting must be automatically updated during creation without blocking the deployment.
This rules out the Deny effect (which blocks deployment) and the Audit effect (which only reports but does not remediate).
3
Select the policy effect that updates properties with the least overhead.
The Modify effect is chosen over DeployIfNotExists.
Modify is designed for direct property changes on the resource itself during creation/update, whereas DeployIfNotExists is intended for deploying auxiliary, nested resources (like diagnostics or backup settings) and would introduce unnecessary template deployment overhead.

Anahtar Kavram

Selecting the correct Azure Policy effect to enforce compliance on resource properties without blocking deployments.
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru