AZ-500 Question #21: Real Exam Question with Answer & Explanation

Question

You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?

Options

• Adevice compliance policies in Microsoft Intune
• BAzure Automation State Configuration
• Capplication security groups
• DAzure Advisor

Explanation

Explanation

Azure Automation State Configuration is correct because it uses PowerShell DSC (Desired State Configuration) to define and enforce a desired configuration state on virtual machines - including disabling unused Windows features - and can be integrated with ARM template deployments to automatically apply these configurations as VMs are provisioned.

Why the distractors are wrong:

• A (Intune device compliance policies): Intune is designed for managing end-user devices (laptops, phones) and enforcing compliance rules, not for automating OS configuration tasks during VM provisioning in Azure IaaS.
• C (Application security groups): These are a network security feature used to group VMs for firewall/NSG rule management - they have nothing to do with OS feature configuration.
• D (Azure Advisor): Advisor is a recommendation tool that provides best-practice suggestions; it does not automate any configuration changes on your behalf.

Memory Tip 🧠

Think of Azure Automation State Configuration as your "enforcer" - it continuously ensures VMs are in the exact state you defined (like a building inspector checking every new house). Whenever you see a question about automatically enforcing or configuring OS-level settings during or after provisioning, think DSC + Azure Automation.

No community discussion yet for this question.