AZ-305 Question 42
Single answerYour company has recently acquired multiple departments, each with its own Azure subscription. Leadership wants to establish strict governance, requiring that any new resources in these subscriptions must include mandatory tags for cost allocation and be created only in approved Azure regions. They also want these requirements automatically applied to any additional subscriptions onboarded in the future. Which approach best meets these requirements with minimal administrative overhead?
- A
Define and assign Azure Policy Initiatives at the root Management Group level to enforce tagging and region restrictions across all subscriptions
- B
Create a Resource Lock in each subscription that prevents the creation of resources outside approved regions unless tags are provided
- C
Apply a custom RBAC role at the Resource Group level in each subscription to require tags and restrict region deployment
- D
Deploy an Azure Resource Graph query to run periodically and remove any resources that do not meet tagging or region requirements
Show answer and explanation
Correct answer: A
Explanation
Using Azure Management Groups at the root level with Azure Policy Initiatives is the recommended governance strategy for enterprise-scale environments. By applying policy assignments and initiatives at this top level, new and existing subscriptions automatically inherit the required compliance settings, such as mandatory tags and permitted regions. This approach follows Microsoft’s best practices, allowing a scalable and systematic governance model. Refer to Microsoft documentation on 'Azure Policy' and 'Management Groups' for details on how to implement policy inheritance across subscriptions: https://docs.microsoft.com/azure/governance/policy/ and https://docs.microsoft.com/azure/governance/management-groups/.
- A. Correct.
Correct: Defining and assigning Azure Policy Initiatives at the root Management Group level automatically applies these policies to existing and future subscriptions. This enforces consistent tagging and region rules across the organization, aligning with Azure best practices for governance.
- B. Incorrect.
Incorrect: Resource Locks only prevent or limit certain actions but cannot be configured to require specific tags or approved regions. They are not a substitute for Azure Policy enforcement.
- C. Incorrect.
Incorrect: RBAC controls who can perform actions on resources, not the configuration or compliance details (e.g. mandatory tags, region restrictions). RBAC alone doesn’t enforce these types of policies.
- D. Incorrect.
Incorrect: Azure Resource Graph is useful for query and inventory purposes. It does not enforce policies or automatically remove resources that violate tagging or region requirements.