4 of the 12 questions we have for this objective, shown with the answer and the reasoning.
Implement governance to enforce security and regulatory compliance
Hollis Games has the Defender CSPM plan enabled on a subscription named Sub-Build. The Microsoft cloud security benchmark recommendation that Key Vaults should use private link is flagged for three vaults in a resource group named rg-ci. These vaults are intentionally reached over the public endpoint by hosted build agents, and the vault firewalls already restrict access to the agent IP ranges. The security team has accepted this risk but wants it re-examined in 180 days, and the recommendation must continue to apply to every other vault in Sub-Build.
What should you do?
- ACreate an exemption for the recommendation scoped to rg-ci, with the Mitigated category, a description of the compensating control, and an expiration date 180 days out.A recommendation exemption at resource group scope removes only those vaults from the finding and secure score, records why, and automatically reinstates the finding when it expires.
- BDisable the private link recommendation in the Microsoft cloud security benchmark standard assigned to Sub-Build.Disabling the recommendation at the standard removes it for every vault in the subscription, not just the three in rg-ci.
- CApply a ReadOnly resource lock to the three vaults so that Defender for Cloud stops evaluating them.Resource locks restrict management operations; they have no effect on Defender for Cloud assessments.
- DRemove the Microsoft cloud security benchmark standard from Sub-Build and assign a custom standard that omits the private link control.Replacing the default benchmark for the whole subscription is far broader than needed and removes the control from every other vault.
Why: Defender for Cloud exemptions let you accept a risk for a specific scope while leaving the recommendation active everywhere else, and they carry a category, justification, and expiry so that the acceptance is auditable and temporary. Exemptions depend on the Microsoft cloud security benchmark being assigned to the subscription and are a Defender CSPM capability, which the scenario provides. The deciding constraints are that only rg-ci is affected, that a compensating control exists (Mitigated), and that the acceptance must be revisited in 180 days. Disabling or replacing the standard is the trap because it silences the control at subscription scope, and locks are unrelated to posture assessment.
Implement governance to enforce security and regulatory compliance
Trellis Health assigned the built-in policy Deploy Diagnostic Settings for Key Vault to Log Analytics workspace with the DeployIfNotExists effect at a subscription named Sub-Prod. Vaults created after the assignment receive diagnostic settings automatically, but the 60 vaults that existed before the assignment show as non-compliant and still have no diagnostic settings. The team wants the existing vaults fixed with minimal administrative effort.
What should you do?
- ACreate a remediation task for the policy assignment, ensuring the assignment's managed identity holds the role required to create diagnostic settings.DeployIfNotExists acts automatically only on new or updated resources; a remediation task applies the deployment to the resources that were already non-compliant, using the assignment's managed identity.
- BChange the effect of the assignment from DeployIfNotExists to Modify.Modify can add or change properties and tags on the evaluated resource itself; it cannot create a separate diagnostic settings resource.
- CTrigger an on-demand compliance evaluation scan on Sub-Prod.A compliance scan re-evaluates and updates the compliance state; it does not deploy anything to non-compliant resources.
- DCreate a policy exemption for the 60 existing vaults with the Mitigated category.An exemption hides the vaults from compliance reporting without deploying diagnostic settings, which leaves them unmonitored.
Why: DeployIfNotExists and Modify policies are enforced at create or update time, so pre-existing resources stay non-compliant until a remediation task is run. The remediation task is what applies the deployment retroactively, and it depends on the assignment's managed identity having the permissions declared in the definition's roleDefinitionIds. The deciding details are that only pre-existing resources are affected and that effort must be minimal. Switching to Modify is the trap because Modify cannot create child resources, and scans and exemptions change reporting rather than configuration.
Implement governance to enforce security and regulatory compliance
Linden Foods backs up 120 virtual machines to a Recovery Services vault named rsv-linden. Administrators must remain able to stop protection and delete backup data when VMs are decommissioned. The security team wants to guarantee that if an administrator or an attacker deletes backup data, the data remains recoverable for at least 14 days, and that this protection cannot be switched off by anyone who gains access to the vault.
What should you configure on rsv-linden?
- ASet the soft delete state to Always-on.Soft delete keeps deleted backup data recoverable for the retention period (14 days by default, extendable up to 180 days with enhanced soft delete), and the Always-on state makes the setting irreversible so no one can disable it, while administrators can still delete backups normally.
- BApply a CanNotDelete resource lock to rsv-linden.A lock prevents deletion of the vault resource itself; it does not stop someone from deleting individual backup items or stopping protection.
- CEnable immutability on rsv-linden.Immutable vault blocks deletion of recovery points before their scheduled expiry for everyone, which conflicts with the requirement that administrators can still delete backup data for decommissioned VMs; it prevents deletion rather than making deleted data recoverable.
- DChange the vault's storage redundancy to geo-redundant storage.Redundancy protects against regional loss; it has no bearing on recovering deliberately deleted backup data.
Why: Soft delete for Azure Backup retains deleted backup data for a configurable period so that malicious or accidental deletion can be undone, and the Always-on state locks the feature so that a compromised administrator cannot disable it before deleting. The deciding constraints are that deletion must remain possible but recoverable and that the setting must be irreversible. Immutable vault is the trap: it is a strong ransomware control but it forbids early deletion outright instead of allowing recovery. Resource locks protect the vault object, not its backup items, and redundancy addresses regional loss.
Implement governance to enforce security and regulatory compliance
Pinecrest Media has eight subscriptions under a management group named mg-pc. A night-shift operations team must be able to view virtual machines and to start, restart, power off, and deallocate them in any of the eight subscriptions. The team must not be able to change VM configuration, manage disks, or manage networking. The security team wants a single reusable role definition.
What should you create?
- AA custom Azure role whose Actions include Microsoft.Compute/virtualMachines/read, start/action, restart/action, powerOff/action, and deallocate/action, with mg-pc as the assignable scope.Listing only the required control-plane actions and placing mg-pc in assignableScopes yields one least-privilege definition that can be assigned in any of the eight subscriptions.
- BAn assignment of the built-in Virtual Machine Contributor role at the mg-pc scope.Virtual Machine Contributor can create and delete VMs, manage disks, and change many configuration settings, which exceeds the requirement.
- CA custom Azure role based on Contributor with NotActions for Microsoft.Compute/virtualMachines/write and Microsoft.Compute/virtualMachines/delete, with mg-pc as the assignable scope.Starting from Contributor and subtracting a few actions still leaves access to every other resource provider, including networking and disks.
- DA custom Microsoft Entra role that includes the virtual machine power actions and assign it to the operations team.Microsoft Entra custom roles govern directory objects such as users and applications; they cannot contain Azure resource provider actions.
Why: Custom Azure roles should be built by allowing exactly the actions required rather than by subtracting from a broad role, and their assignableScopes determine where they can be assigned, so a management group scope makes a single definition reusable across many subscriptions. The deciding constraints are power operations only and a single reusable definition. The NotActions approach is the classic trap because what is not denied remains allowed, and Microsoft Entra custom roles are a different system that controls directory permissions, not Azure resources.