Microsoft Cybersecurity Architect (SC-100)Design security for infrastructureMedium
A large enterprise is designing its Azure landing zone. They need to ensure that all virtual machines (VMs) deployed in the environment automatically conform to security baselines, including specific OS configurations, patch levels, and software installations. Furthermore, any deviation from these baselines must be automatically remediated. Which Azure service combination is most effective for achieving this continuous compliance and automated remediation for VMs?
- AAzure Update Manager and Azure Backup
- BAzure Resource Manager templates and Azure DevOps
- CAzure Policy and Azure Automation
- DAzure Security Center (Defender for Cloud) and Azure Monitor
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Policy and Azure Automation
Azure Policy can define and enforce security baselines and compliance rules across Azure resources, including VMs. Azure Automation can then be used to create runbooks that automatically remediate non-compliant resources identified by Azure Policy, ensuring continuous compliance and automated patching/configuration.
Why the other options are wrong
- A. Azure Update Manager handles patching, but not general configuration enforcement and remediation. Azure Backup is for data recovery.
- B. ARM templates define initial deployments, not continuous compliance. Azure DevOps manages CI/CD pipelines.
- D. Azure Security Center (Defender for Cloud) identifies compliance issues, but Azure Policy/Automation provide the enforcement and remediation mechanisms. Azure Monitor collects logs.
Azure Policy & Azure Automation for VM Security
Azure Policy defines and enforces security standards, while Azure Automation executes tasks to remediate non-compliant VMs.
- Azure Policy offers built-in and custom definitions to enforce security baselines.
- Azure Automation runbooks can perform actions like patching, installing software, or changing configurations.
- Together, they enable continuous compliance and automated remediation.
Memory trick: Policy sets the rules, Automation fixes the breaks.