AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Policy for tag enforcement, Azure RBAC for scoping tag modification to Finance, and Azure Policy for compliance reporting

  Why this is correct

  The correct combination uses Azure Policy to assign a tag requirement at the root or intermediate management group, so the Deny or Modify effects apply consistently across every subscription and the Policy compliance dashboard gives finance stakeholders a continuously updated report of noncompliant resources. Azure RBAC then grants the Finance team the Tag Contributor built-in role at the necessary scope, letting them edit tag keys and values without broader write access. Because compliance reporting is generated from the same Azure Policy assignments, no separate monitoring or security tool is needed. This is the only option that both enforces the policy and correctly identifies the reporting service.

• ✗

  Azure Blueprints with tag policy and Azure RBAC, and Azure Security Center for compliance

  Why it's wrong here

  Azure Blueprints is not needed here because the tag requirement is a single policy or initiative assignment, not a full environment archetype with multiple artifacts such as ARM templates and role assignments; Blueprints is also deprecated in favor of Policy/Initiatives and Template Specs, so depending on it is poor architectural judgment. RBAC alone can permit the Finance team to add tags, but it cannot force anyone to add them or stop a developer from creating a resource missing the tag—actual enforcement requires an Azure Policy effect. Azure Security Center, now Microsoft Defender for Cloud, reports on security posture and workload security, not tag governance, so this stack would leave the enterprise without a tag compliance report.

• ✗

  Azure Policy for tag enforcement, Azure Management Groups for governance, and Azure Monitor for compliance reports

  Why it's wrong here

  Management Groups provide an efficient policy assignment boundary and help organize a large subscription hierarchy, but they are only containers—they do not evaluate resources or produce compliance results; the actual evaluation and reporting must come from Azure Policy. Azure Monitor collects platform metrics, activity logs, and resource diagnostics and can alert on operational conditions, but it has no native view of policy compliance or tag presence. This pairing also omits Azure RBAC, so there is no defined mechanism restricting tag edits to the Finance team, meaning any contributor could change tags. A complete solution must combine policy assignment for enforcement, role-based access control for delegation, and the Azure Policy compliance dashboard for reporting.

• ✗

  Azure Policy for tag enforcement, Azure RBAC for tag modification, and Azure Security Center for compliance

  Why it's wrong here

  The first two components are correct—Azure Policy should enforce the tag rule, and Azure RBAC should constrain tag modifications to Finance—so the flaw is the compliance-reporting service. Microsoft Defender for Cloud (formerly Azure Security Center) evaluates security configurations such as endpoint protection, encryption, firewall rules, and secure-score recommendations; it does not audit whether resources carry a required cost-center tag. Tag compliance is measured by Azure Policy's built-in compliance view, which shows percentage compliance and the per-resource evaluation state for the assignment. Because this option puts a security tool in place of Azure Policy's reporting function, it is incomplete and incorrect.

Go deeper

Related to this question