Microsoft Certified: Azure Security Engineer AssociateManage security operationsEasy
A security engineer is configuring a new Azure subscription and needs to ensure that all resources deployed within it meet specific organizational security standards, such as requiring encryption at rest for all storage accounts and restricting network access to virtual machines. They want to define a set of rules that apply uniformly across the subscription. Which Azure service is primarily used to define and enforce these security standards?
- AAzure Monitor
- BAzure Sentinel
- CAzure Policy
- DAzure Security Center
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Policy
Azure Policy is a service that enables you to create, assign, and manage policies that control your Azure resources. These policies enforce rules and effects over your resources to ensure they stay compliant with your corporate standards and service level agreements, making it ideal for defining and enforcing security standards like encryption and network restrictions.
Why the other options are wrong
- A. Azure Monitor is for collecting, analyzing, and acting on telemetry data from your Azure and on-premises environments, not for defining and enforcing resource configuration standards.
- B. Azure Sentinel is a cloud-native SIEM (Security Information and Event Management) solution used for threat detection, investigation, and response, not for defining resource configuration policies.
- D. Azure Security Center (now Microsoft Defender for Cloud) provides security posture management and threat protection, but it relies on Azure Policy for the enforcement of many of its recommendations.
Azure Policy
A service in Azure that helps enforce organizational standards and assess compliance at scale.
- Defines rules for resource properties and configurations.
- Can audit, deny, or modify resources.
- Integrates with other Azure services like Defender for Cloud.
Memory trick: Azure Policy 'sets the rules' for your 'cloud kingdom'.