AZ-305 Question 40
Select 2You are designing an Azure governance strategy for a global organization with multiple subscriptions across different regions and business units. The organization requires consistent application of security and compliance policies for all new resources while allowing each business unit to manage its own deployments within defined constraints. Which of the following design decisions would best meet these requirements?
- A
A. Use a single management group at the root and apply one global policy to enforce governance across all subscriptions, disallowing any overrides.
- B
B. Establish a hierarchical structure of management groups aligned with business units, applying Azure Policies at higher levels so they inherit down to subscriptions.
- C
C. Implement Azure Blueprints at the subscription level to package RBAC assignments, policies, and resource templates for consistent deployments.
- D
D. Manually track resource configurations with Excel spreadsheets to ensure all subscriptions follow the same compliance rules.
- E
E. Grant each business unit’s resource owners the Owner role at the top-level management group to allow flexibility in policy enforcement.
Show answer and explanation
Correct answers: B, C
Explanation
By creating a hierarchy of management groups (Option B) aligned with how the organization is structured, you can apply Azure Policies at appropriate layers, ensuring inheritance of governance rules. In addition, implementing Azure Blueprints at the subscription level (Option C) allows you to package RBAC, policies, and resource layouts for standardized, repeatable deployments. Together, these approaches help maintain both consistency and flexibility. For more information, refer to Microsoft documentation on Azure Management Groups (https://learn.microsoft.com/azure/governance/management-groups) and Azure Blueprints (https://learn.microsoft.com/azure/governance/blueprints).
- A. Incorrect.
Option A is not ideal, because applying a single global policy without allowing structured overrides can hinder flexibility in different business units and prevent targeted governance approaches where needed.
- B. Correct.
Option B is correct. Organizing management groups in a hierarchy aligned to business units and applying Azure Policies at appropriate levels ensures consistent inheritance of governance rules while enabling more granular control as needed.
- C. Correct.
Option C is correct. Azure Blueprints allow bundling of essential governance components such as policies, RBAC, and resource templates, ensuring consistent deployments at the subscription level.
- D. Incorrect.
Option D is incorrect. Relying on manual tracking in spreadsheets introduces a high risk of errors and non-compliance, and it does not scale well in a large organization.
- E. Incorrect.
Option E is incorrect. Granting Owner privileges at the top-level management group essentially bypasses the governance structure by allowing unregulated changes and overrides, defeating the purpose of centralized governance.