Knowledge check

1.

A security engineer assigns the 'Windows machines should meet requirements of the Azure compute security baseline' policy. The policy shows noncompliant resources for some VMs even though the VMs are healthy. What two prerequisites must be present on the VM for the policy to evaluate compliance?

Log Analytics agent and Azure Monitor agent

Azure Machine Configuration extension and system-assigned managed identity

Microsoft Defender for Endpoint agent and Guest Attestation extension

2.

After admins author and locally test a custom Azure Machine Configuration package, what is the correct sequence of steps to deploy it using Azure Policy?

Upload to Azure Storage → create a custom policy definition referencing the package → assign the policy

Upload to Azure Key Vault → reference it in a policy initiative → deploy via Defender for Cloud

Commit to a GitHub repository → link to Azure Policy as a code-based policy → autodeploy

3.

A security engineer is preparing to deploy Azure Machine Configuration OS baseline enforcement across Contoso Manufacturing's production VMs. Which initial approach minimizes the risk of service disruption?

Assign in enforce mode immediately to close compliance gaps as quickly as possible

Deploy in audit mode first to identify noncompliant settings, then promote to enforce mode after reviewing the issues

Apply Azure Policy built-in initiatives with Deny effect at the management group scope

Check your knowledge

Feedback