Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceHard
A manufacturing company has multiple Azure subscriptions organized under a management group. They want to ensure a consistent configuration of Azure Key Vaults across all subscriptions within this management group, specifically enforcing a minimum key length for all newly created keys. Additionally, they need to prevent the deletion of any Key Vaults once deployed. Which two Azure governance features should they combine to meet these requirements?
- AAzure Policy and Azure Resource Locks
- BAzure Management Groups and Azure AD Conditional Access
- CAzure Blueprints and Azure Resource Locks
- DAzure Security Center and Azure Policy
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Policy and Azure Resource Locks
Azure Policy can enforce the minimum key length for Key Vault keys by auditing or denying non-compliant creations. Azure Resource Locks provide the functionality to prevent deletion of Key Vaults. Combining these two features directly addresses both requirements.
Why the other options are wrong
- B. Azure Management Groups organize subscriptions, and Azure AD Conditional Access controls user access, neither directly enforces key length nor prevents resource deletion.
- C. Azure Blueprints can deploy and enforce standards, but Azure Policy is more direct for enforcing specific property settings like key length, and Resource Locks are needed for deletion prevention.
- D. Azure Security Center provides security posture management, and while it interacts with policies, Azure Policy itself is the direct enforcement mechanism for key length, and Resource Locks for deletion prevention.
Azure Policy and Resource Locks Combination
Azure Policy enforces configuration standards and compliance across resources, while Azure Resource Locks protect resources from accidental deletion or modification.
- Policy for 'what' configurations are allowed/required.
- Resource Locks for 'who' can delete/modify resources.
- Combined for comprehensive governance and protection.
Memory trick: Policy sets the rules, Locks keep things in place.