AZ-305 Practice Question: Design identity, governance, and monitoring solutions
You are designing a governance strategy for an Azure environment that includes multiple subscriptions. The security team requires that all storage accounts must have HTTPS traffic only. Any non-compliant storage account must be automatically remediated. What is the most efficient solution?
⚠ Common exam trap
Test-takers frequently confuse Azure Policy's DeployIfNotExists effect with Azure Blueprints, assuming Blueprints can also remediate, but Blueprints only enforce initial compliance and do not provide ongoing automatic remediation for existing resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic
Azure Policy with a DeployIfNotExists effect can automatically remediate non-compliant storage accounts by enabling the 'HTTPS traffic only' property. This approach ensures continuous compliance without manual intervention, meeting the security team's requirement for automatic remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an Azure Blueprint that includes a policy initiative
Why it's wrong here
An Azure Blueprint packages templates, policies, and roles for orchestrated deployment, but assigning a blueprint does not retroactively fix resources that already exist. Its policy initiative would only be evaluated on new deployments or when a resource is updated, so non-compliant storage accounts created before the blueprint assignment remain unchanged. Blueprints lack the remediation engine that Azure Policy's DeployIfNotExists effect provides, making it ineffective for this governance scenario.
- ✗
Assign a custom RBAC role that denies creation of storage accounts without HTTPS
Why it's wrong here
Azure RBAC is an identity-based authorization system that determines who can perform actions like creating or deleting resources, not the configuration state of those resources. A custom role that denies creation of storage accounts without HTTPS would block future non-compliant creation but cannot inspect or modify existing storage accounts to enforce HTTPS-only traffic. Because the goal is to remediate already-deployed resources, RBAC is a prevention mechanism, not a remediation mechanism.
- ✓
Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic
Why this is correct
Azure Policy with the DeployIfNotExists effect evaluates every existing resource against the definition and automatically triggers a remediation task to deploy the required configuration — in this case, setting the 'supportsHttpsTrafficOnly' property to true. This effect uses a managed identity to apply the change, and it can be run on-demand via a remediation task or on a schedule, ensuring all non-compliant storage accounts are brought into compliance without manual intervention. This is the only option that provides automated, continuous enforcement and correction for resources already in the subscription.
- ✗
Configure Azure Monitor alerts to notify the security team
Why it's wrong here
Azure Monitor alerts are designed to detect and notify, not to act; they can signal the security team that a storage account is non-compliant, but they cannot change the account's configuration. Even if an alert triggers a runbook or an Azure Function, that would be a separate, custom automation workflow, not an intrinsic governance capability. For an automated governance strategy, relying solely on alerts leaves a gap where non-compliant resources remain until a human or external process responds.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.