You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are…

Question

Options

• Adevice configuration policies in Microsoft Intune
• Ban Azure Desired State Configuration (DSC) virtual machine extension
• Csecurity policies in Azure Security Center
• DAzure Logic Apps

• B
  95% (19)
• D
  5% (1)

Explanation

Explanation

Azure Desired State Configuration (DSC) is the right tool here because it integrates directly with ARM templates as a VM extension, allowing you to define and enforce a desired configuration (such as disabling Windows features) automatically at provisioning time - exactly what the question requires. DSC continuously ensures the VM stays in the defined state, making it ideal for enforcing OS-level configurations during and after deployment.

Option A (Intune device configuration policies) is incorrect because Intune is designed for managing enrolled client devices, not for automating server configuration during ARM template deployments. Option C (Azure Security Center security policies) focuses on monitoring and threat detection/compliance posture, not on actively disabling OS features. Option D (Azure Logic Apps) is a workflow automation service used for integrating services and business processes, not for configuring VM operating system settings at provisioning.

Memory Tip: Think of DSC as a "blueprint enforcer" - just like an ARM template defines your infrastructure, DSC defines your configuration state. When you see keywords like "automatically," "provisioned," and "Windows features," think DSC extension - it plugs directly into ARM templates and speaks PowerShell DSC natively.

No community discussion yet for this question.