Question
Your on-premises network contains an Active Directory domain named contoso.com and 500 servers that run Windows Server. All the servers are Azure Arc-enabled and joined to contoso.com.
You need to implement PowerShell Desired State Configuration (DSC) on all the servers. The solution must minimize administrative effort.
Where should you store the DSC scripts, and what should you use to apply DSC to the servers? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Store in: An Azure Automation account. The Automation account hosts Azure Automation State Configuration, where you import, compile, and keep DSC configurations and modules centrally. An Azure App Configuration store holds application settings and feature flags, not DSC configurations, and an Azure Policy definition is a rule that describes what to evaluate or enforce, not a place to keep scripts.
Use: Guest configuration in Azure Policy. Guest configuration (Azure Machine Configuration) audits and applies DSC-based settings inside the operating system, and it works on Azure Arc-enabled servers through the Connected Machine agent just as on Azure VMs, so a single policy assignment at the subscription or resource group scope covers all 500 servers with minimal administrative effort. A GPO in AD DS cannot deliver or enforce PowerShell DSC configurations without custom startup scripts, and deploying VM extensions machine by machine does not give the central, policy-driven assignment and compliance reporting that guest configuration provides.
