AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company has an Azure subscription with many resource groups. The security team requires that all diagnostic settings for every Azure resource be automatically configured to send logs to a central Log Analytics workspace. You need to design a solution that enforces this configuration at scale without manual intervention. What should you include in the design?
⚠ Common exam trap
The trap here is assuming that Azure Monitor alerts or Azure Automation can automatically enforce configuration, when they are event-driven and require custom logic, unlike Azure Policy which provides declarative, continuous compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a built-in Azure Policy that uses the DeployIfNotExists effect to deploy diagnostic settings for each resource type.
Azure Policy with the DeployIfNotExists effect is designed to automatically deploy required configurations, such as diagnostic settings, when non-compliant resources are detected. It continuously evaluates resources and can remediate them, ensuring that all resources send logs to the central workspace without manual intervention. This provides scalable, consistent enforcement across the environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Blueprints to assign a policy that audits diagnostic settings and manually remediate non-compliant resources.
Why it's wrong here
Azure Blueprints can assign policies, but the audit effect only reports compliance; it does not automatically remediate. Manual remediation does not meet the requirement for automatic configuration. Blueprints are also being deprecated in favor of Template Specs and Deployment Stacks, so it is not the best choice.
- ✓
Assign a built-in Azure Policy that uses the DeployIfNotExists effect to deploy diagnostic settings for each resource type.
Why this is correct
Azure Policy with DeployIfNotExists can automatically deploy diagnostic settings when a resource is created or updated. It evaluates the resource and, if the setting is missing, triggers a deployment to add it. This enforces compliance at scale across subscriptions and resource groups, meeting the requirement without manual effort.
- ✗
Create an Azure Monitor alert rule that triggers an Azure Automation runbook to enable diagnostic settings when a resource is created.
Why it's wrong here
Azure Monitor alerts are reactive and based on metrics or logs, not resource creation events. There is no native alert for resource creation. An Automation runbook could be triggered by an event grid, but that requires custom code and is not as declarative or scalable as Azure Policy. It also does not guarantee compliance.
- ✗
Configure Azure Monitor diagnostic settings on each resource type using an ARM template and deploy it to all resource groups.
Why it's wrong here
An ARM template can deploy diagnostic settings, but it only applies at deployment time and only to resources included in the template. It does not automatically apply to new resources created later. This approach requires manual updates and does not enforce configuration at scale, making it insufficient.
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.