Microsoft Security Operations AnalystMitigate threats using Microsoft Defender for CloudHard
A financial services company uses Microsoft Defender for Cloud to monitor its Azure environment. Due to strict regulatory requirements, they must ensure that all Azure SQL Databases are encrypted at rest with customer-managed keys (CMK) from Azure Key Vault. The security team wants to enforce this policy and automatically remediate any non-compliant SQL databases. Which Azure Policy effect, when assigned at the subscription level, can achieve this enforcement and auto-remediation goal?
- ADeployIfNotExists
- BDeny
- CAudit
- DModify
Show answer & explanationAnswer & explanation
Correct answer: D. Modify
The 'Modify' effect in Azure Policy is designed to update existing resources or settings on existing resources. In this scenario, it can be used to automatically configure Azure SQL Databases to use customer-managed keys for encryption at rest if they are not already configured that way. This satisfies both enforcement and auto-remediation.
Why the other options are wrong
- A. The 'DeployIfNotExists' effect is used to deploy a resource if a condition is not met, often for missing resources. While it can configure child resources, 'Modify' is more direct for altering existing resource properties.
- B. The 'Deny' effect would prevent the creation of non-compliant resources or block updates, but would not automatically configure existing ones.
- C. The 'Audit' effect only reports non-compliance, it does not enforce or remediate.
Azure Policy 'Modify' Effect
The 'Modify' effect in Azure Policy is used to add, update, or remove properties or tags on existing Azure resources or resource groups, enabling automatic remediation of non-compliant configurations.
- Requires a managed identity to perform changes.
- Can be used to enforce specific configurations (e.g., encryption settings, tags).
- Applies to existing resources and can be used on new creations.
Memory trick: Policy effects: Audit, Deny, Deploy, Modify – each has a job.