CV0-004 Security Practice Question
A cloud operations team is hardening a Microsoft Azure subscription that hosts production virtual machines. The security lead wants to ensure that only approved operating system images can be deployed and that any drift from the baseline configuration is automatically detected. Which TWO Azure services should be implemented to meet these goals? (Choose two.)
⚠ Common exam trap
The trap here is selecting broad posture or advisory tools like Defender for Cloud or Advisor, which report on compliance but do not enforce image approval or continuously detect configuration drift.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with a custom definition restricting allowed image publishers and offers
Azure Policy with a custom image restriction definition enforces that only approved OS images can be deployed, directly satisfying the image control requirement. Azure Automation State Configuration continuously evaluates VMs against a DSC baseline and reports drift, satisfying the drift detection requirement. Together they provide both preventive and detective controls for the production subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy with a custom definition restricting allowed image publishers and offers
Why this is correct
Azure Policy can enforce that VMs may only be created from approved image publishers, offers, and SKUs by evaluating the imageReference property. This directly prevents deployment of unapproved operating system images. Combined with a drift-detection service, it fulfills the requirement to restrict images to an approved set.
- ✗
Azure Policy with the built-in 'Allowed virtual machine size SKUs' initiative
Why it's wrong here
Azure Policy can restrict VM sizes, but the 'Allowed virtual machine size SKUs' initiative only controls compute SKUs, not which operating system images are permitted. It does not address image approval or configuration drift detection, so it does not satisfy either stated requirement.
- ✓
Azure Automation State Configuration (DSC)
Why this is correct
Azure Automation State Configuration uses PowerShell DSC to define a desired-state configuration for VMs and continuously checks for drift. When a node deviates from the baseline, it can report and optionally remediate. This satisfies the requirement to automatically detect configuration drift on production virtual machines.
- ✗
Azure Advisor security recommendations
Why it's wrong here
Azure Advisor provides best-practice recommendations based on telemetry, but it does not enforce image approval policies or detect per-VM configuration drift. Its security recommendations are advisory only and cannot block unapproved images or continuously monitor baseline compliance, so it does not meet the stated goals.
- ✗
Microsoft Defender for Cloud regulatory compliance dashboard
Why it's wrong here
The regulatory compliance dashboard in Defender for Cloud provides assessment and reporting against standards like PCI DSS or ISO 27001, but it does not enforce approved images at deployment time nor detect configuration drift on VMs. It is a reporting and posture tool, not an enforcement or drift detection mechanism.
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.