Microsoft Azure Security Technologies (AZ-500)

Which solution allows a custom antimalware virtual machine extension to be installed on every Azure virtual machine?

1. DeployIfNotExists

2. AuditIfNotExists

3. Modify

4. Disabled

The correct answer is: DeployIfNotExists

The solution that allows a custom antimalware virtual machine extension to be installed on every Azure virtual machine is DeployIfNotExists. This policy definition is designed to ensure that a specified resource exists in the environment. When this condition is not met, the policy automatically deploys the required resource. In this case, by using DeployIfNotExists, Azure evaluates each virtual machine to check if the custom antimalware extension is present. If it is not detected, Azure takes action to automatically deploy the extension on those virtual machines. This automation helps maintain compliance with security measures without manual intervention. Using DeployIfNotExists is beneficial for organizations looking to enforce security standards across multiple virtual machines consistently, ensuring that all are protected by the required antimalware solution. Other options like AuditIfNotExists would only report on the absence of the desired extension without automatically deploying it, while Modify would alter existing resources rather than install new ones. The Disabled option would entirely prevent the deployment of extensions, which would not meet the requirement for ensuring that every virtual machine has the custom antimalware extension installed.