Your company has an Azure environment with a single subscription. You are designing an Azure Policy strategy to enforce the following governance and compliance requirements:
- Prevent the deployment of resources that do not have a required 'CostCenter' tag.
- Automatically deploy a diagnostic settings extension to new virtual machines to ensure monitoring compliance.
Which two Azure Policy effects should you use to meet these requirements? (Select two.)
- DenyCevap
- DeployIfNotExistsCevap
- CAudit
- DModify
Cevap
Use the Deny effect to prevent resource creation without the required tag, and the DeployIfNotExists effect to automatically deploy the diagnostic settings extension to virtual machines.
To satisfy the governance requirements, the Deny effect is used to block resource deployment when the required tag is missing. The DeployIfNotExists effect is used to deploy a template or resource extension (like diagnostics settings) when a resource is created, providing automated remediation without manual intervention.
Adım Adım Çözüm
Anahtar Kavram
Azure Policy effects determine what happens when a policy rule is evaluated during resource creation or modification.