Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Exhibit

{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk",
          "exists": "true"
        }
      ]
    },
    "then": {
      "effect": "auditIfNotExists",
      "details": {
        "type": "Microsoft.Compute/virtualMachines/extensions",
        "existenceCondition": {
          "field": "Microsoft.Compute/virtualMachines/extensions/publisher",
          "equals": "Microsoft.Azure.Security"
        }
      }
    }
  }
}

Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?

⚠ Common exam trap

The trap here is that candidates focus on the `existenceCondition` or effect syntax, overlooking that the parent `field` condition silently fails on VMs without managed disks, preventing the entire policy from evaluating.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy condition requires a managed disk, but the VMs might have unmanaged disks.

The policy condition uses `field` to check for `Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.id`, which requires the VM to have a managed disk. If the VMs use unmanaged disks (i.e., the `managedDisk` property is absent), the condition evaluates to false, and the `auditIfNotExists` effect never triggers the existence check for the Azure Security extension.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy condition requires a managed disk, but the VMs might have unmanaged disks.
Why this is correct
The policy definition's 'if' clause matches only VMs that have a managed disk (e.g., by checking that the 'managedDisk' property is present). VMs that still use unmanaged disks do not satisfy this condition, so the 'auditIfNotExists' effect is never evaluated for them. Consequently, the policy silently ignores the very machines that likely need the missing-extension audit, making the compliance report incomplete rather than identifying all noncompliant VMs.
✗
The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.
Why it's wrong here
This option is incorrect because in an 'auditIfNotExists' policy, the 'existenceCondition' field paths are evaluated relative to the child resource type specified in 'details.type' (e.g., 'Microsoft.Compute/virtualMachines/extensions'), not relative to the parent virtual machine. Therefore, using just 'publisher' is the correct field reference—it directly accesses the extension resource's property. Pre-pending the full type path would be invalid because Azure Policy would attempt to resolve a non-existent property within the already-scoped extension resource.
✗
The policy is assigned to a management group, but the VMs are in a subscription under a different management group.
Why it's wrong here
A policy assigned at a management group scope automatically applies to every child management group and subscription within that hierarchy. If the VMs' subscription is a descendant of the management group where the policy is assigned, the assignment reaches those VMs regardless of how many other management groups exist above them. The only way this option would be valid is if the subscription were in a completely separate management group tree, which is not the case in the exhibit—so inheritance makes this a non-issue.
✗
The policy effect should be 'Deny' instead of 'auditIfNotExists'.
Why it's wrong here
The 'auditIfNotExists' effect is correct for a security audit because it evaluates existing VMs and flags them as noncompliant without disrupting current workloads. Changing to 'Deny' would only block the creation of future resources and would not provide any visibility into already-deployed VMs, defeating the purpose of an audit. Furthermore, the real problem is the overly restrictive 'if' condition, not the effect; switching effects would mask the underlying issue and could cause unintended deployment failures for legitimate resources.

Go deeper

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question