AZ-305 Question 48
Select 2A company needs to ensure that all new and existing Azure resources adhere to internal compliance standards across multiple subscriptions. They want to streamline the distribution and enforcement of these standards, maintain versioning for their governance artifacts, and rapidly handle compliance requirements for different environments. What should you recommend to meet these requirements?
- A
Use Azure Policy to define and enforce organizational standards, combined with Azure Blueprints for packaging and deploying sets of policies at scale.
- B
Rely on role assignments in Azure RBAC to ensure continuous resource compliance and governance across subscriptions.
- C
Create an alert rule in Azure Resource Graph to automatically remediate non-compliant resources in real time.
- D
Use Azure Blueprints to maintain a versioned blueprint definition that includes policies, role assignments, and ARM templates.
Show answer and explanation
Correct answers: A, D
Explanation
To manage compliance at scale, you should build on Azure Policy to define and enforce required configurations, and then use Azure Blueprints to package and version these policies (along with other governance artifacts) for easy deployment across multiple subscriptions. Azure RBAC addresses authorization rather than policy-driven configuration compliance, and Azure Resource Graph is focused on querying resource properties, not enforcing compliance. For more details, refer to Azure Policy (https://learn.microsoft.com/azure/governance/policy/) and Azure Blueprints documentation (https://learn.microsoft.com/azure/governance/blueprints/).
- A. Correct.
Option 1: CORRECT. Azure Policy provides rules to enforce resource configurations and ensure compliance. Pairing it with Azure Blueprints allows you to package policies, role assignments, and ARM templates together, making it easier to deploy and manage compliance standards across multiple environments.
- B. Incorrect.
Option 2: INCORRECT. Azure RBAC manages permissions and access, but not compliance rules. It doesn’t enforce resource configurations to comply with specific standards. While RBAC is critical for providing least-privilege access, it doesn’t address compliance enforcement.
- C. Incorrect.
Option 3: INCORRECT. Azure Resource Graph is for querying and exploring resource information at scale. It does not automatically enforce or remediate compliance rules. Alerts can highlight issues but not enforce policies or handle version control.
- D. Correct.
Option 4: CORRECT. Azure Blueprints supports versioning of governance artifacts and allows packaging of policies, role assignments, and ARM templates. This feature simplifies deploying consistent compliance and governance packages across multiple subscriptions.