AZ-305 Design infrastructure solutions Practice Question
Your organization is implementing a security strategy for Azure resources. You need to enforce consistent security policies across all subscriptions and ensure compliance with regulatory standards. Which TWO services should you use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud
Microsoft Defender for Cloud (B) is correct because it provides continuous security assessment and regulatory compliance dashboards against standards such as ISO 27001, PCI DSS, and NIST, letting you measure and enforce compliance across subscriptions. Azure Policy (E) is correct because it enforces organizational standards and assesses compliance at scale by evaluating resource properties against policy definitions and applying deny, audit, or deployIfNotExists effects across all subscriptions. Together they cover both policy enforcement and regulatory compliance monitoring. Azure RBAC (A) only controls who can perform actions on resources and does not enforce configuration or regulatory standards. Microsoft Sentinel (C) is a SIEM/SOAR solution for threat detection and incident response, not policy or compliance enforcement. Azure Blueprints (D) orchestrates deployments of artifacts including policies, but it is a deployment/governance packaging tool rather than the service that itself enforces and reports compliance across subscriptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC
Why it's wrong here
Manages access control, not policy enforcement.
- ✓
Microsoft Defender for Cloud
Why this is correct
Microsoft Defender for Cloud continuously assesses Azure resources against regulatory benchmarks such as ISO 27001 and PCI DSS, surfacing compliance posture across every subscription through its regulatory compliance dashboard. This satisfies the stem's requirement for consistent policy enforcement and demonstrated regulatory compliance, complementing Azure Policy's preventive controls with detection and recommendations.
- ✗
Microsoft Sentinel
Why it's wrong here
SIEM solution, not for policy enforcement.
- ✗
Azure Blueprints
Why it's wrong here
Deprecated; replaced by deployment stacks and policy.
- ✓
Azure Policy
Why this is correct
Azure Policy evaluates resource properties against built-in or custom definitions, then enforces effects such as deny, audit, or deployIfNotExists across every subscription in scope. This directly satisfies the stem's requirement to enforce consistent security policies across all subscriptions, while its regulatory compliance dashboard maps assignments to standards such as ISO 27001 and PCI DSS.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.