AZ-305 Design infrastructure solutions Practice Question
Which TWO of the following are benefits of using Azure Policy? (Choose two.)
⚠ Common exam trap
Many candidates confuse Azure Policy's ability to enforce rules (like tagging) with automatic remediation, but automatic remediation requires explicit configuration of the 'deployIfNotExists' or 'modify' effect and a remediation task, making it not a direct benefit of simply using Azure Policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assess compliance of resources against defined policies
Azure Policy is a service that enables you to create, assign, and manage policies that enforce rules and effects over your Azure resources. Option A is correct because one of its primary benefits is the ability to assess the compliance state of existing and newly deployed resources against defined policy definitions, providing a clear compliance dashboard and reports. This assessment is continuous and can be viewed at the subscription, management group, or resource group level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assess compliance of resources against defined policies
Why this is correct
Azure Policy continuously evaluates existing and newly deployed resources against policy definitions and initiatives, aggregating the results into a compliance dashboard that shows per-policy and per-resource compliance states. This assessment process covers properties like resource types, locations, and configuration settings, enabling organizations to identify drift from corporate standards even after enrollment.
- ✓
Enforce tagging conventions on resources
Why this is correct
Azure Policy enforces tagging conventions by defining rules that require specific tags to exist on resources, or that constrain tag values to approved sets. It can also inherit tags from resource groups or subscriptions, and use effects like deny or append to block non-compliant resource creation, while existing resources can be aligned through remediation tasks.
- ✗
Manage access control for resources
Why it's wrong here
Azure Policy does not manage access control because it lacks the capability to assign roles or grant user permissions; that is the responsibility of Azure RBAC, which authenticates and authorizes identities via role assignments. Azure Policy only evaluates and enforces resource configuration properties, meaning a user's ability to read, write, or delete a resource remains entirely governed by RBAC, not by policy definitions.
- ✗
Create new Azure resources based on a template
Why it's wrong here
Azure Policy is an evaluation and enforcement service, not a resource provisioning engine; it does not create virtual machines, storage accounts, or any other Azure resources. Resource creation is performed by Azure Resource Manager through templates, Bicep files, or other deployment tools, while Azure Policy only inspects resources after (or during) deployment to decide whether they comply, possibly denying the operation but never instantiating anything itself.
- ✗
Automatically remediate non-compliant resources without manual intervention
Why it's wrong here
While Azure Policy can remediate non-compliant resources using the 'modify' effect or via deployment tasks, this is not automatic for all policies; many policies rely on 'audit' or 'deny' effects, which either log non-compliance or block creation but never correct existing resources. When remediation does occur, it requires an explicit remediation task to be created, which uses a managed identity and is executed as an asynchronous operation, not a transparent and universal automatic process.
Go deeper
Related to this question
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.