Match each Azure governance tool to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Enforce rules and compliance for resources
Define repeatable set of Azure resources and policies
Hierarchical structure for managing access and policies
Query and explore Azure resources across subscriptions
Monitor, allocate, and optimize cloud costs
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Azure Policy: Enforces rules and compliance across resources.
Azure Policy enforces rules; Azure Blueprints provides repeatable templates; Management Groups organize subscriptions; RBAC controls access. Confusions often arise between policy enforcement and access control, or between blueprints and management groups.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Azure Policy: Enforces rules and compliance across resources.
Why this is correct
Azure Policy applies explicit rules codified as JSON policy definitions, assigned to management groups, subscriptions, or resource groups. During resource creation and at each compliance evaluation cycle, Policy inspects properties such as location, SKU, or tags and triggers an effect like Deny, Audit, or Modify, ensuring that both existing and newly deployed resources conform to organizational standards.
Azure Blueprints: Provides a repeatable set of resources and policies for compliance.
Why this is correct
Azure Blueprints orchestrates deployment of a governance package by bundling ARM template resources, Policy assignments, and role assignments into a single versioned artifact. When assigned to a subscription, it provisions a repeatable, auditable compliance baseline, and central teams can publish updated blueprint versions to track which subscriptions still align with the organization's architectural requirements.
Azure Management Groups: Organizes subscriptions into a hierarchy for policy inheritance.
Why this is correct
Azure Management Groups form a transitive, hierarchical structure above subscriptions, allowing grouping by business unit, environment, or geography. Policy and RBAC assignments made at a management group level automatically inherit down to all child subscriptions and resource groups, and the hierarchy supports up to six levels of nesting for granular control and consolidated governance.
Azure RBAC: Controls access to resources by assigning roles.
Why this is correct
Azure RBAC is Azure's identity-based authorization system that grants a principal (user, group, service principal, or managed identity) access to a particular scope by assigning a role such as Owner, Contributor, or Reader. Role assignments are evaluated at the control plane when a caller attempts an action, and they can be refined with conditions, deny assignments, or custom roles to control exactly who can perform what action on a resource.
Azure Policy: Controls access to resources by assigning roles.
Why it's wrong here
This statement stops Azure Policy with Azure RBAC, because access control is achieved by assigning roles to identities, not by Policy definitions. Policy evaluates resource configuration and uses effects such as Deny or Audit; it never considers the requesting user or role assignment. Authorization for actions falls solely within RBAC, which manages permissions separately from configuration compliance.
Azure Blueprints: Organizes subscriptions into a hierarchy.
Why it's wrong here
Azure Blueprints does not organize or hierarchically arrange subscriptions; rather, it provisions a curated collection of Azure resources, Policy assignments, and RBAC assignments inside a subscription as a versioned deployment package. Hierarchical ordering of subscriptions is the purpose of Management Groups, which create inheritance paths for policy and access assignments, whereas Blueprints serve as a deployment and compliance-packaging orchestration tool.
Quick reference
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.