Question
You have an Azure subscription.
You need to create and deploy an Azure policy that meets the following requirements:
- When a new virtual machine is deployed, automatically install a custom security extension.
- Trigger an autogenerated remediation task for non-compliant virtual machines to install the extension.
What should you include in the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Definition effect: DeployIfNotExists runs a template deployment when the related resource is missing, which is how a VM extension gets installed, and remediation tasks can apply that template to existing resources. Modify and Append change properties on the resource being evaluated and cannot deploy an extension, while EnforceOPAConstraint and EnforceRegoPolicy relate to Kubernetes admission control.
For remediation, define: Azure Policy runs remediation with a managed identity associated with the policy assignment, not a service principal, so the service principal options are wrong. The identity needs Contributor because deploying the extension means writing resources, whereas User Access Administrator only manages authorization and cannot deploy anything.
