A governance team must confirm that every VM in the production subscriptions has a required endpoint protection extension and an encrypted OS disk. Non-compliant VMs should be surfaced automatically, and the missing extension should be installable through a remediation task. Which mechanism is correct?
Show answer and explanation
Answer: C
Azure Policy assignments evaluate existing and new VMs against defined conditions, so audit effects flag resources that do not meet the standard. For a missing extension, a deployIfNotExists policy can be remediated through a remediation task that deploys the extension to non-compliant machines. Secure Score and Advisor suggest improvements without enforcing them, and Blueprints act at deployment time without continuing to evaluate existing machines.
Why the other options are wrong
- A. Secure Score ranks security posture and lists recommendations, but it does not evaluate every VM against a required extension or fix gaps by itself.
- B. Advisor offers cost, reliability and performance guidance; it is not a compliance engine that flags a missing endpoint protection extension.
- D. Blueprints place resources during deployment but do not keep checking existing VMs, so drift and later-missing extensions go unnoticed.