Design security solutions for infrastructure →mediumMultiple Choice

SC-100 Design security solutions for infrastructure Practice Question

Exhibit

Refer to the exhibit.
{
  "properties": {
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          },
          {
            "field": "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration.enableAutomaticUpdates",
            "exists": "false"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Refer to the exhibit. You are reviewing an Azure Policy definition. What is the effect of this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Denies creation of Windows VMs without automatic updates enabled

The correct answer is D: the policy denies creation of Windows VMs without automatic updates enabled. In Azure Policy, a Deny effect blocks the deployment request when the resource does not satisfy the condition, so a Windows VM whose automatic updates setting is not enabled would fail the policy evaluation and be rejected. This matches the scenario of enforcing automatic updates on Windows VMs at creation time. Option A is incorrect because it reverses the condition, denying VMs that already have automatic updates enabled. Option B is incorrect because it describes an Audit effect, not Deny, and audits VMs with updates disabled rather than blocking noncompliant deployments. Option C is incorrect because it targets Linux VMs and uses Audit, neither of which matches the policy's Windows VM Deny behavior.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Denies creation of Windows VMs that have automatic updates enabled
Why it's wrong here
This option reverses the condition's logic. The policy rule's if block uses an 'exists' operator with value 'false' on the field 'Microsoft.Compute/virtualMachines/enableAutomaticUpdates', so it evaluates to true only when that property is absent from the request payload. A VM that explicitly sets enableAutomaticUpdates to true would have the property present, making the condition false and allowing creation, which is the opposite of what this option claims.
✗
Audits Windows VMs that have automatic updates disabled
Why it's wrong here
Although this option asserts an audit behavior, the policy's then block specifies 'effect': 'deny' rather than 'audit' or 'auditIfNotExists'. Moreover, the condition does not test whether the property equals 'false' or 'Disabled'; it only tests for the absence of the enableAutomaticUpdates property. An audit for disabled updates would require a different condition, such as checking the property value, and a different effect, so this answer fails on both the effect and the evaluation logic.
✗
Audits Linux VMs that have automatic updates enabled
Why it's wrong here
This answer is doubly incorrect: the policy definition scopes its type match to 'Microsoft.Compute/virtualMachines' with a Windows-focused property, and the effect is deny, not audit. Linux VMs are represented by the same resource type but do not use the 'enableAutomaticUpdates' property in the same way, and Azure Policy would not apply an audit effect here. The actual rule denies when the property is missing, so it cannot produce an audit outcome for Linux workloads.
✓
Denies creation of Windows VMs without automatic updates enabled
Why this is correct
This is correct because the condition uses 'exists': 'false' on the 'Microsoft.Compute/virtualMachines/enableAutomaticUpdates' field. When a deployment request for a Windows VM omits the enableAutomaticUpdates property, the condition is met and the deny effect blocks the create or update operation. This forces callers to explicitly include the property on the VM resource to pass the policy.

Go deeper

SC-100 Design security solutions for infrastructure Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question