AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your company has multiple Azure subscriptions managed by different teams. You need to design a governance solution that ensures: 1) All subscriptions must have a consistent set of policies (e.g., allowed locations, allowed VM SKUs). 2) Compliance reports must be generated daily for each subscription. 3) Non-compliant resources must be automatically remediated where possible (e.g., add tags). 4) The solution must use a single management group hierarchy. What should you include in the design?
⚠ Common exam trap
Candidates often assume Azure Blueprints (Option B) are required for consistent governance, but Blueprints are for initial environment setup, not ongoing policy enforcement and automatic remediation, which is the core of this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a management group hierarchy, assign Azure Policy at the root management group level with both 'audit' and 'deployIfNotExists' effects, and use a daily Logic App to query compliance via Azure Resource Graph and send reports.
Assigning Azure Policy at the root management group level ensures consistent policy enforcement across all subscriptions in the hierarchy. The 'deployIfNotExists' effect enables automatic remediation (e.g., adding missing tags), while a daily Logic App querying Azure Resource Graph can generate compliance reports without manual intervention. This design satisfies all requirements with a single management group hierarchy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a management group hierarchy, assign Azure Policy at the root management group level with both 'audit' and 'deployIfNotExists' effects, and use a daily Logic App to query compliance via Azure Resource Graph and send reports.
Why this is correct
Assigning Azure Policy at the root management group scopes the policy to all nested subscriptions, ensuring uniform governance across the entire tenant. Using both audit and deployIfNotExists effects allows you to first assess non-compliant resources and then automatically trigger remediation tasks to fix them without manual intervention. A daily Logic App calling Azure Resource Graph to query compliance aggregates results across subscriptions and can automatically email a report, providing a scalable, native reporting mechanism.
- ✗
Create a management group hierarchy and use Azure Blueprints to assign policies and role assignments per subscription.
Why it's wrong here
Azure Blueprints has been deprecated and is no longer recommended for new deployments; its capabilities have been superseded by native Azure Policy, management groups, and role assignments. While Blueprints could assign policies and roles, doing so per subscription is an outdated and less flexible approach. Even if the hierarchy is correct, relying on a deprecated service risks future support and feature stagnation, making this a poor architectural choice for ongoing governance.
- ✗
Use Azure DevOps to deploy a pipeline that runs PowerShell scripts to enforce policies and generate reports.
Why it's wrong here
Using Azure DevOps pipelines with PowerShell scripts is an imperative, ad-hoc approach that does not provide continuous, platform-native compliance enforcement. Azure Policy is declarative and automatically evaluates resources during creation and throughout their lifecycle, whereas scripts must be manually run or scheduled and do not integrate with Azure's compliance dashboard or remediation capabilities. This approach also lacks centralized reporting and can drift, as scripts require constant maintenance to keep up with resource changes.
- ✗
Create a custom Azure Policy initiative with all required policies and assign it to each subscription individually.
Why it's wrong here
Assigning a custom Azure Policy initiative to each subscription individually is operationally inefficient and creates a fragmentation point, as each subscription's assignment must be managed and updated separately. This approach is prone to inconsistency and human error, and it does not scale as subscriptions are added or removed. Assigning the initiative at the root management group ensures inheritance to all child subscriptions, enabling centralized policy management and streamlined compliance monitoring.
Go deeper
Related to this question
Learn chapter
Designing Governance Solutions
Key term
Management Group Design
A logical hierarchy of Azure management groups that organizes subscriptions and applies governance policies consistently across an organization.
Key term
Subscription Design
Subscription Design is the structured approach to organizing and managing Azure subscriptions to align with business requirements, governance policies, and cost management.
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.