AZ-400 Question 195
Single answerYour security team mandates that all existing and newly provisioned Windows and Linux virtual machines in your subscription adhere to a common security baseline that includes specific OS settings and mandatory software. They also require a centralized compliance dashboard in the Azure portal to easily identify configurations that deviate from the baseline. You need to ensure that any new VM added to the subscription automatically adopts these settings and reports its compliance status. Which solution should you implement?
- A
Deploy custom scripts to each virtual machine via the Azure VM extension to configure the baseline upon creation
- B
Use Bicep templates in a CI/CD pipeline to redeploy VM configurations whenever the security baseline changes
- C
Use Azure Automanage Machine Configuration with a custom guest configuration policy assigned at the subscription level
- D
Use Azure Automation State Configuration (DSC) with an on-premises pull server to continuously enforce configurations
Show answer and explanation
Correct answer: C
Explanation
Azure Automanage Machine Configuration leverages Azure Policy to ensure that newly created and existing virtual machines remain aligned with the required security baseline. This approach includes a compliance dashboard in the Azure portal, enabling quick identification of noncompliant VMs. By targeting the subscription level, you ensure these configurations are automatically applied to all virtual machines at the time of provisioning. For more details, refer to Microsoft� documentation on Azure Automanage Machine Configuration and Azure Policy guest configuration.
- A. Incorrect.
Option 1 is incorrect: Deploying custom scripts via extensions can configure VMs at creation, but it does not offer a built-in compliance dashboard in the Azure portal nor automatically reapply configurations when the script changes unless you set up additional processes. It also lacks integration with Azure Policy-based compliance reporting.
- B. Incorrect.
Option 2 is incorrect: Bicep is designed primarily for deploying and managing Azure resources' infrastructure rather than enforcing ongoing desired state configurations within the operating system. While you can redeploy templates, this method does not provide continuous compliance or a built-in dashboard for real-time monitoring of OS-level settings.
- C. Correct.
Option 3 is correct: Azure Automanage Machine Configuration uses Azure Policy guest configuration to automatically apply and monitor configurations across Windows and Linux VMs. By assigning the configuration at the subscription level, every new VM inherits the policy at creation, and you benefit from ongoing monitoring and a built-in compliance view in the Azure portal.
- D. Incorrect.
Option 4 is incorrect: Azure Automation State Configuration (DSC) can enforce configurations, but using an on-premises pull server requires additional overhead and does not provide native Azure Policy-based compliance reporting. You would have to set up external dashboards or configure integration for compliance visibility.