AZ-500 Question 211
Select 3Your organization manages multiple Azure subscriptions across different departments. The security team wants to ensure all resources are properly inventoried, tagged, and monitored to maintain compliance and a clear audit trail. They have asked you to recommend approaches for centralizing asset management and enforcing required tags. Which three approaches should you implement to achieve consistent asset management across all subscriptions? (Select three answers.)
- A
Create and assign an Azure Policy initiative that enforces mandatory tags and naming conventions for all resources.
- B
Enable a multi-factor authentication (MFA) policy for every user account to enforce secure access to Azure resources.
- C
Use Azure Resource Graph queries to discover and list all resources across subscriptions in a unified manner.
- D
Enable ‘Public network access’ for all resources to streamline resource discovery and management.
- E
Utilize the Microsoft Defender for Cloud Inventory feature to track and visualize resources across subscriptions.
Show answer and explanation
Correct answers: A, C, E
Explanation
To effectively manage assets at scale in Azure, you typically combine multiple tools and services. Azure Policy ensures resources meet organizational tagging and naming requirements. Azure Resource Graph queries help you discover and query resources across subscriptions. The Inventory feature in Microsoft Defender for Cloud provides a consolidated view to track resource security posture. Refer to the official Microsoft documentation on Azure Policy (https://docs.microsoft.com/azure/governance/policy/overview), Azure Resource Graph (https://docs.microsoft.com/azure/governance/resource-graph/overview), and Microsoft Defender for Cloud (https://docs.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction) for more details on best practices.
- A. Correct.
Option 1: Correct. Azure Policy is commonly used to automatically enforce tagging policies and naming conventions, ensuring all resources comply with your organization’s standards upon creation. This approach simplifies governance and helps maintain an accurate asset inventory.
- B. Incorrect.
Option 2: Incorrect. While enabling MFA is an important security control for identity and access management, it does not by itself help with centralizing or enforcing asset management or tagging policies. MFA helps protect user accounts, not track or tag resources.
- C. Correct.
Option 3: Correct. Azure Resource Graph lets you query and discover resources across multiple subscriptions. This tool helps provide a centralized view of resources, making it easier to verify compliance with naming and tagging standards and to detect unmanaged or unexpected assets.
- D. Incorrect.
Option 4: Incorrect. Enabling public network access for all resources is not recommended for security or asset management. It increases the attack surface. Resource discovery should be accomplished via Azure-native tools instead of exposing resources to the public internet.
- E. Correct.
Option 5: Correct. Microsoft Defender for Cloud includes an Inventory feature that provides you with a consolidated view of your Azure resources. It helps you monitor and track assets across subscriptions, making it easier to manage security and compliance.