AZ-305 Question 50
Single answerA financial services organization must ensure that Azure resources in multiple subscriptions comply with government data protection standards. They want to prevent the deployment of non-compliant resources, track compliance statuses across subscriptions, and automatically remediate configuration drift where possible. Which solution should you recommend?
- A
Create a custom Azure Blueprint that defines resource group structures only.
- B
Implement Azure Policy with relevant built-in definitions at the management group level and monitor compliance through the Azure Policy blade.
- C
Use Azure Cost Management to identify non-compliant resources and manually enforce standards.
- D
Enable Azure Resource Locks on all resources to prevent unauthorized changes.
Show answer and explanation
Correct answer: B
Explanation
Azure Policy is the recommended Azure service for enterprise-grade compliance enforcement across subscriptions. By assigning policies at the management group level, you can ensure consistent governance and remediation of non-compliant resources. For more information and best practices, see Microsoft documentation on Azure Policy: https://docs.microsoft.com/azure/governance/policy/.
- A. Incorrect.
Option 1 is incorrect because creating a custom Azure Blueprint that only defines resource group structures does not suffice for ongoing compliance enforcement. While Azure Blueprints can include policies, simply defining the structure without including enforced policy definitions will not automatically prevent or remediate non-compliant resources.
- B. Correct.
Option 2 is correct because Azure Policy allows you to assign built-in or custom policy definitions at the management group level, ensuring both new and existing resources comply with standards. You can also enable remediation tasks to bring resources into compliance and track overall compliance in the Azure Policy blade.
- C. Incorrect.
Option 3 is incorrect because Azure Cost Management primarily focuses on cost visibility and optimization, not compliance enforcement. While you might identify some resources that require attention, it does not provide ongoing policy enforcement or auto-remediation of compliance issues.
- D. Incorrect.
Option 4 is incorrect because Azure Resource Locks only prevent modifications or deletions to resources. They do not enforce specific compliance controls or track alignment with data protection standards.