AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a custom Azure Policy definition that enforces encryption at rest and denies public network access.

  Why this is correct

  Creating a custom Azure Policy definition is the direct way to enforce these requirements because Azure Policy can evaluate resource properties and apply effects like Deny to prevent non-compliant deployments. For instance, you can use the policy to target the 'publicNetworkAccess' property and storage encryption settings, ensuring every attempted resource creation in scope is validated. This allows you to precisely control both encryption at rest and network exposure in a single governance rule.

• ✗

  Assign the built-in Azure Policy initiative 'ISO 27001:2013' to the production subscription.

  Why it's wrong here

  Assigning the ISO 27001:2013 initiative fails because it provides a broad framework for information security management, not a guarantee to enforce the specific technical controls like denying public network access and encryption at rest required by the scenario's regulatory compliance. These granular controls often necessitate individual, targeted Azure Policy definitions or a custom initiative. This option is tempting as ISO 27001 is a recognised standard, and the initiative helps establish a baseline security posture across an environment, making it suitable for general alignment with the standard.

• ✓

  Assign a custom Azure Policy definition at the management group that contains the production subscription.

  Why this is correct

  Assigning a custom Azure Policy definition at the management group that contains the production subscription is correct because policy assignments are inherited by all child subscriptions and resource groups under that management group. This centralized approach guarantees that the production subscription, and any future subscriptions added to that hierarchy, will automatically receive the policy without needing to remember multiple assignments. It also offers a single place to manage exclusions and exceptions, simplifying governance administration and audit reporting.

• ✗

  Create an Azure role-based access control (RBAC) role to enforce encryption and network restrictions.

  Why it's wrong here

  An Azure RBAC role defines what actions a security principal can perform on Azure resources, such as create, read, update, or delete, but it cannot enforce configuration settings like encryption at rest or deny public network access. RBAC governs access to the control plane, never the internal settings of a resource. Therefore, this approach is fundamentally wrong because it does not apply any technical control; it merely permits or denies who can manage resources.

• ✓

  Configure Azure Blueprints to include the custom policy assignment and assign the blueprint to the production subscription.

  Why this is correct

  Azure Blueprints can package a custom Azure Policy definition and its assignment as a blueprint artifact, and assigning the blueprint to the production subscription deploys the policy assignment automatically. Blueprints also allow bundling of Azure Resource Manager templates, role assignments, and resource groups, making them a comprehensive tool for spinning up a fully compliant baseline environment. This method is especially useful when you need to roll out a consistent governance package across multiple subscriptions, ensuring the custom policy is applied exactly as intended.

• ✗

  Use Azure Resource Graph to audit resources that do not meet compliance requirements.

  Why it's wrong here

  Azure Resource Graph is a powerful query tool for exploring resource properties at scale, so you could use it to identify resources that are missing encryption or have public network access enabled. However, it is purely a discovery and reporting service; it cannot enforce policies, block non-compliant resource creation, or continuously audit compliance. Enforcement is the role of Azure Policy, whereas Resource Graph only returns the state of resources when queried and has no effect on their configuration.

Go deeper

Related to this question