Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsEasy
A global consulting firm uses Azure to host client applications. They need to ensure that all new Azure Storage Accounts deployed across all client subscriptions are configured with a minimum TLS version of 1.2 to meet security compliance standards. This policy must be enforced automatically at the time of resource creation and prevent non-compliant deployments. Which Azure service should be used to achieve this?
- AAzure Management Groups
- BAzure Security Center
- CAzure Monitor
- DAzure Policy
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Policy
Azure Policy allows you to define, assign, and manage standards for your Azure resources. It can enforce rules at the time of resource creation, preventing non-compliant resources from being deployed, and can also audit existing resources for compliance. Enforcing a minimum TLS version is a perfect use case for Azure Policy.
Why the other options are wrong
- A. Azure Management Groups are used to organize subscriptions and apply policies at scale, but Azure Policy is the underlying service that defines and enforces the actual policy rules.
- B. Azure Security Center (now Defender for Cloud) provides security posture management and threat protection, but it doesn't directly enforce resource configuration standards at deployment time like Azure Policy.
- C. Azure Monitor collects and analyzes telemetry data, used for monitoring performance and availability, not for enforcing configuration standards at the time of resource creation.
Azure Policy
Azure Policy is a service in Azure that you use to create, assign, and manage policies that enforce rules and effects over your resources to stay compliant with your corporate standards and service level agreements.
- Enforces rules and effects on Azure resources
- Can audit, deny, or modify resource deployments
- Supports built-in and custom policy definitions
- Applied at various scopes (management group, subscription, resource group)
Memory trick: Azure Policy Polices Your Resources.