AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your Azure environment includes multiple subscriptions that are managed by different teams. You need to ensure that all resources are compliant with your company's security policies, and any non-compliant resources must be automatically remediated or reported. Which solution should you implement?
⚠ Common exam trap
Test-takers frequently confuse Azure Policy (for governance and remediation) with Azure Blueprints (for environment setup) or Microsoft Defender for Cloud (for security monitoring), but only Azure Policy with remediation tasks provides the automatic, continuous enforcement and remediation required for compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with remediation tasks
Azure Policy with remediation tasks is the correct solution because it allows you to define and enforce security policies across multiple subscriptions, and automatically remediate non-compliant resources using managed identities and DeployIfNotExists or Modify policy effects. This ensures continuous compliance without manual intervention, meeting the requirement for both automatic remediation and reporting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy with remediation tasks
Why this is correct
Azure Policy with remediation tasks is correct because DeployIfNotExists and Modify effects can automatically correct non-compliant resources when the policy is assigned. A managed identity is assigned to the policy definition, and remediation tasks run on existing resources, while new resources are fixed during creation. This provides continuous, automated enforcement across your subscriptions, making it the only option that actively remediates configuration drift, not just reports it.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints, though designed to package policy assignments and ARM templates, only applies that package at blueprint assignment time. It does not continuously evaluate or fix resources that later drift from a compliant state, and it is now deprecated in favor of platform-native capabilities like deployment stacks. Choosing a blueprint would not satisfy the 'automatically remediate' requirement, and relying on a deprecated service is not a sustainable architecture.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC governs who can perform actions on resources by assigning permissions to role definitions, such as Contributor or Owner. While RBAC can grant a remediation application permission to modify resources, it does not itself assess compliance or execute any configuration changes. RBAC is purely an identity authorization mechanism, so it cannot detect whether a resource is non-compliant or trigger a remediation task on its own.
- ✗
Microsoft Defender for Cloud
Why it's wrong here
Microsoft Defender for Cloud provides security recommendations and integrates with Azure Policy to assess resources, but it does not automatically apply remediation. You can view a recommendation and manually click 'fix' or create a policy from it, but Defender itself does not run remediation tasks. It lacks the DeployIfNotExists/Modify effects that drive automated correction; it may surface the issue, but actual remediation requires Azure Policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.