AZ-305 Design infrastructure solutions Practice Question
Your company has an Azure subscription that contains several virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with a baseline security policy that includes specific registry key settings. The solution must automatically remediate non-compliant settings without manual intervention. What should you use?
⚠ Common exam trap
AZ-305 often tests the confusion between Azure Policy with Guest Configuration and Azure Automation State Configuration (DSC). Both can enforce and remediate VM settings and report on compliance, but Azure Policy with Guest Configuration is the Azure-native governance solution that audits and automatically remediates in-guest settings (including registry keys) at scale, with compliance reporting integrated into Azure Policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with Guest Configuration
Azure Policy with Guest Configuration is designed to audit and enforce settings inside VMs, including registry keys, and supports automatic remediation via DeployIfNotExists and Modify effects. It uses a guest configuration extension to evaluate the VM's configuration and can remediate non-compliant settings without manual intervention. This meets the requirement of ensuring compliance with a baseline security policy and automatic remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Automation State Configuration (DSC)
Why it's wrong here
Azure Automation State Configuration (DSC) applies and remediates configuration on VMs, but it targets machine state rather than evaluating registry settings against a security baseline policy with automatic remediation. It would be correct for enforcing desired-state configuration such as installing features, not for policy-driven compliance remediation.
- ✓
Azure Policy with Guest Configuration
Why this is correct
Azure Policy with Guest Configuration audits and remediates settings inside VMs via the Guest Configuration extension, applying the DeployIfNotExists effect to install and configure the agent. This satisfies the stem's requirement for automatic remediation of registry key settings without manual intervention, which subscription-level policy alone cannot achieve.
- ✗
Microsoft Defender for Cloud with custom recommendations
Why it's wrong here
Microsoft Defender for Cloud with custom recommendations assesses resources and surfaces findings, but recommendations alone do not automatically remediate non-compliant registry key settings without manual intervention. It would be the right choice for continuous security posture assessment and alerting, not for enforcing and remediating a baseline configuration.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune manages devices enrolled in mobile device management, including Windows clients, but Azure VMs running Windows Server are not enrolled as Intune-managed endpoints, so it cannot enforce registry baseline settings on them. It would be correct for managing corporate laptops and mobile devices, not Azure infrastructure VMs.
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.