Question
You have 100 on-premises servers that run Windows Server and are Azure Arc-enabled.
You have an Azure subscription.
You deploy a Custom Script Extension to the servers by using the following Azure Resource Manager (ARM) template.
You regenerate the storage account key and update the template.
You need to meet the following requirements:
• Ensure that the script runs again on the servers.
• Minimize the risk of the key being compromised on the servers.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
To ensure that the script runs again: Modify the value of the timestamp property. The Custom Script Extension runs a script only once. It runs it again only when the extension configuration changes. The timestamp setting exists for exactly this purpose: change it to any integer different from the previous value to trigger a rerun. Setting autoUpgradeMinorVersion to true only allows newer minor versions of the extension handler to be used and does not rerun the script. Raising typeHandlerVersion selects a different handler version and is not the supported way to rerun the script.
To minimize the risk of a compromised key: Move the storageAccountName property and the storageAccountKey property to the protectedSettings object. Public settings are sent to the server in clear text and saved there that way. Protected settings are encrypted with a key known only to Azure and the machine. The documentation also requires storageAccountName and storageAccountKey to be placed together in protectedSettings. Managed identity is not an option here. The Custom Script Extension does not currently support managed identity authentication on Azure Arc-enabled servers. The managedIdentity property must also be specified only in protected settings and cannot be combined with storageAccountName, which both managedIdentity options leave in place.
