Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Enforcing IaC Compliance with Azure Policy
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is implementing Infrastructure as Code (IaC) to automate the deployment of virtual machines, subnets, and storage resources. The security team needs a solution to ensure that all infrastructure configurations defined in code adhere to internal governance rules and regulatory compliance standards across their environment.
Which Azure capability should the organization use to enforce governance standards and audit resource compliance?
Explanations
Azure Active Directory Data Plane Authentication
Azure Active Directory Data Plane Authentication
What Azure Active Directory Data Plane Authentication Is
Azure Active Directory (Azure AD / Microsoft Entra ID) data plane authentication enables users, applications, and managed identities to authenticate securely when accessing the data stored within specific Azure resources (such as Blob storage or Key Vault secrets).
Why It Doesn't Meet the Requirement
Data plane authentication focuses exclusively on identity verification and access permissions for interacting with data inside a provisioned service. It does not provide tools for auditing infrastructure configuration code or enforcing regulatory governance across cloud resource deployments.
Key Characteristics and Limitations
- Identity verification: Authenticates identities for data operations rather than infrastructure deployment rules.
- Role-based access: Grants fine-grained read, write, and execute permissions on service data.
- No governance evaluation: Cannot validate whether infrastructure templates conform to organizational security baselines.
This Answer Would Be Correct If
The objective was to ensure that client applications and users authenticate using centralized identity credentials when accessing the data stored inside an Azure service.
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a core governance and compliance service in Azure that allows organizations to define, assign, and manage business rules and standards across their cloud environment. It evaluates cloud resources during deployment and continuously post-deployment to ensure that configurations align with organizational baselines and regulatory frameworks.
How It Meets the Compliance and IaC Requirement
When paired with Infrastructure as Code (IaC) workflows, Azure Policy acts as an automated guardrail. It can prevent the creation of non-compliant resources defined in templates or audit existing deployments against predefined compliance baselines. If an IaC template attempts to deploy a resource that violates a corporate security rule (such as creating an unencrypted storage account or omitting required security parameters), Azure Policy can block the deployment or flag it for remediation.
Key Advantages and Capabilities
- Automated enforcement: Evaluates IaC deployments in real time and prevents configurations that violate security standards.
- Built-in compliance benchmarks: Includes built-in policy initiatives mapped to industry standards such as PCI-DSS, ISO 27001, and the Microsoft Cloud Security Benchmark.
- Continuous auditing: Regularly scans deployed resources to detect and report configuration drift across subscriptions.
- Remediation tasks: Supports automated remediation to bring non-compliant resources back into alignment without manual intervention.
Why This Is Optimal
Azure Policy integrates natively with resource management layers, ensuring that governance is enforced consistently whether resources are created via the Azure portal, CLI, or automated IaC pipelines.
Azure Automation Update Management
Azure Automation Update Management
What Azure Automation Update Management Is
Azure Automation Update Management is an operational tool designed to manage, schedule, and deploy operating system updates and security patches for Windows and Linux virtual machines running in Azure, on-premises, or in other cloud environments.
Why It Doesn't Meet the Requirement
While patch management is an essential element of infrastructure security, Update Management only addresses OS-level software updates inside virtual machines. It does not evaluate IaC templates, assess cloud resource architecture, or enforce corporate compliance rules on cloud infrastructure configurations.
Key Characteristics and Limitations
- OS patch scanning: Evaluates virtual machines for missing operating system security updates.
- Scheduled deployments: Automates the installation of approved patches during maintenance windows.
- Limited scope: Cannot evaluate or restrict infrastructure properties like network configurations, encryption settings, or resource locations.
This Answer Would Be Correct If
The scenario required a service to automatically deploy operating system security patches and updates to Windows and Linux virtual machines.
Network Security Groups (NSGs)
Network Security Groups (NSGs)
What Network Security Groups (NSGs) Are
Network Security Groups (NSGs) are virtual networking security controls used to filter network traffic to and from Azure resources connected to Azure Virtual Networks. They contain security rules that allow or deny inbound and outbound network traffic based on IP addresses, ports, and protocols.
Why It Doesn't Meet the Requirement
An NSG is an individual infrastructure component configured to protect network boundaries, rather than a broad governance framework. While IaC templates often define NSGs to secure subnets, NSGs themselves cannot evaluate whether an entire deployment complies with organization-wide governance standards or regulatory benchmarks.
Key Characteristics and Limitations
- Traffic filtering: Evaluates layer 3 and layer 4 network traffic using 5-tuple matching (source IP, source port, destination IP, destination port, protocol).
- Resource-level scope: Applies specifically to virtual network subnets and network interfaces.
- No policy auditing: Cannot audit or enforce organizational standards on storage, compute SKUs, or other non-network services.
This Answer Would Be Correct If
The scenario focused specifically on defining firewall-like rules to restrict or allow inbound and outbound traffic to virtual machines and subnets.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Bicep vs ARM Templates
Describe infrastructure as code (IaC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Pipelines IaC CI/CD Automation
Describe infrastructure as code (IaC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Templates Declarative IaC
Describe infrastructure as code (IaC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor
Describe the resources required for virtual machines
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure CLI vs Azure PowerShell Syntax
Describe Azure Cloud Shell, including Azure Command-LineInterface (CLI) and Azure PowerShell
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated