AZ-305 Design data storage solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Policy: Enforces rules and compliance across resources.

  Why this is correct

  Azure Policy applies explicit rules codified as JSON policy definitions, assigned to management groups, subscriptions, or resource groups. During resource creation and at each compliance evaluation cycle, Policy inspects properties such as location, SKU, or tags and triggers an effect like Deny, Audit, or Modify, ensuring that both existing and newly deployed resources conform to organizational standards.

• ✓

  Azure Blueprints: Provides a repeatable set of resources and policies for compliance.

  Why this is correct

  Azure Blueprints orchestrates deployment of a governance package by bundling ARM template resources, Policy assignments, and role assignments into a single versioned artifact. When assigned to a subscription, it provisions a repeatable, auditable compliance baseline, and central teams can publish updated blueprint versions to track which subscriptions still align with the organization's architectural requirements.

• ✓

  Azure Management Groups: Organizes subscriptions into a hierarchy for policy inheritance.

  Why this is correct

  Azure Management Groups form a transitive, hierarchical structure above subscriptions, allowing grouping by business unit, environment, or geography. Policy and RBAC assignments made at a management group level automatically inherit down to all child subscriptions and resource groups, and the hierarchy supports up to six levels of nesting for granular control and consolidated governance.

• ✓

  Azure RBAC: Controls access to resources by assigning roles.

  Why this is correct

  Azure RBAC is Azure's identity-based authorization system that grants a principal (user, group, service principal, or managed identity) access to a particular scope by assigning a role such as Owner, Contributor, or Reader. Role assignments are evaluated at the control plane when a caller attempts an action, and they can be refined with conditions, deny assignments, or custom roles to control exactly who can perform what action on a resource.

• ✗

  Azure Policy: Controls access to resources by assigning roles.

  Why it's wrong here

  This statement stops Azure Policy with Azure RBAC, because access control is achieved by assigning roles to identities, not by Policy definitions. Policy evaluates resource configuration and uses effects such as Deny or Audit; it never considers the requesting user or role assignment. Authorization for actions falls solely within RBAC, which manages permissions separately from configuration compliance.

• ✗

  Azure Blueprints: Organizes subscriptions into a hierarchy.

  Why it's wrong here

  Azure Blueprints does not organize or hierarchically arrange subscriptions; rather, it provisions a curated collection of Azure resources, Policy assignments, and RBAC assignments inside a subscription as a versioned deployment package. Hierarchical ordering of subscriptions is the purpose of Management Groups, which create inheritance paths for policy and access assignments, whereas Blueprints serve as a deployment and compliance-packaging orchestration tool.