Microsoft Azure Fundamentals (AZ-900)Describe Azure identity, security, and networkingHard
A security administrator needs to implement a policy that automatically encrypts all newly created virtual machine disks in an Azure subscription. This policy must be enforced consistently across all resource groups. Which Azure service can be used to achieve this compliance requirement?
- AAzure Monitor
- BAzure Policy
- CAzure Advisor
- DAzure Security Center
Show answer & explanationAnswer & explanation
Correct answer: B. Azure Policy
Azure Policy helps to enforce organizational standards and to assess compliance at scale. It can be used to implement policies such as requiring encryption on all new virtual machine disks across an entire subscription or specific resource groups, ensuring consistent compliance.
Why the other options are wrong
- A. Azure Monitor collects and analyzes telemetry data, not for enforcing resource configuration policies.
- C. Azure Advisor provides recommendations for best practices, but does not enforce them.
- D. Azure Security Center provides security posture management and threat protection, but doesn't directly enforce resource configuration policies.
Azure Policy
A service that helps to enforce organizational standards and to assess compliance at scale.
- Defines custom policies to enforce rules and effects.
- Evaluates resources for non-compliance.
- Can be used for governance, security, and cost management.
Memory trick: Azure Policy enforces the rules across your cloud kingdom.