Azure Governance practice questions

A company has a policy that all Azure Storage accounts must have diagnostic settings enabled to send logs and metrics to a specific Log Analytics workspace. The governance team wants to automatically configure these diagnostic settings when a new storage account is created, without blocking the initial creation. The solution must not require manual intervention. Which Azure Policy effect should the team use in their policy definition?

Trap 1: Audit

The Audit effect generates a compliance log entry whenever a storage account without diagnostic settings is found, but it performs no deployment or modification. It only signals that the resource does not meet the policy condition, leaving the diagnostic setting absent. Because the requirement is to enforce automatic configuration, Audit alone cannot satisfy it—it lacks any mechanism to add the missing diagnostic setting.

Trap 2: Deny

Deny prevents the creation of resources that do not meet the policy condition. In this case, it would block the creation of a storage account that lacks diagnostic settings, which contradicts the requirement to allow creation and then automatically configure.

Trap 3: Append

Append is used to add additional fields or properties to an existing resource during creation or update, such as adding a tag. It cannot deploy a separate resource like a diagnostic setting, so it is not suitable for this scenario.

A
DeployIfNotExists
DeployIfNotExists is the correct effect because it automatically deploys a diagnostic setting to any Azure Storage account that is missing one during policy evaluation. When the policy assignment's managed identity has the necessary Azure RBAC permissions (e.g., Storage Account Contributor or Monitor Contributor), it creates the diagnostic setting without blocking the storage account's creation. This effect also supports remediation tasks to fix existing non-compliant accounts, ensuring the policy requirement is enforced continuously.
B
Audit
Why wrong: The Audit effect generates a compliance log entry whenever a storage account without diagnostic settings is found, but it performs no deployment or modification. It only signals that the resource does not meet the policy condition, leaving the diagnostic setting absent. Because the requirement is to enforce automatic configuration, Audit alone cannot satisfy it—it lacks any mechanism to add the missing diagnostic setting.
C
Deny
Why wrong: Deny prevents the creation of resources that do not meet the policy condition. In this case, it would block the creation of a storage account that lacks diagnostic settings, which contradicts the requirement to allow creation and then automatically configure.
D
Append
Why wrong: Append is used to add additional fields or properties to an existing resource during creation or update, such as adding a tag. It cannot deploy a separate resource like a diagnostic setting, so it is not suitable for this scenario.

Question 2mediummultiple choice

A company has a critical Azure Storage account that stores immutable backups. The IT administrator wants to ensure that no one can delete or modify this storage account, even administrators with Contributor or Owner roles. The company still needs to allow read access to the data within the storage account. Which Azure governance feature should the administrator implement?

Trap 1: Azure Policy with Deny effect

Azure Policy with Deny effect can block the creation or modification of resources that violate compliance rules, but it does not prevent the deletion of an existing resource. It also does not inherently provide a blanket lock that protects any resource from being deleted by an Owner. This option is incorrect because the requirement is to secure an already deployed resource from deletion and modification, not to enforce compliance during deployment.

Trap 2: Azure Blueprint with role assignment

Azure Blueprints are used to orchestrate the deployment of resource groups, policies, role assignments, and resources in a repeatable manner. They help maintain consistency across environments but do not themselves enforce immutability on existing resources. This option is incorrect because a Blueprint cannot prevent an Owner from deleting a resource after it is deployed.

Trap 3: Azure role-based access control (RBAC) with Reader role

Assigning the Reader role to all users would prevent them from making changes, but it does not protect the storage account from an administrator who has the Owner or Contributor role. Those higher-privileged roles include permissions to delete resources. A resource lock is required to override the Owner's permissions. Therefore, RBAC alone is insufficient.

A
Azure Policy with Deny effect
Why wrong: Azure Policy with Deny effect can block the creation or modification of resources that violate compliance rules, but it does not prevent the deletion of an existing resource. It also does not inherently provide a blanket lock that protects any resource from being deleted by an Owner. This option is incorrect because the requirement is to secure an already deployed resource from deletion and modification, not to enforce compliance during deployment.
B
Azure Blueprint with role assignment
Why wrong: Azure Blueprints are used to orchestrate the deployment of resource groups, policies, role assignments, and resources in a repeatable manner. They help maintain consistency across environments but do not themselves enforce immutability on existing resources. This option is incorrect because a Blueprint cannot prevent an Owner from deleting a resource after it is deployed.
C
Azure Resource Manager read-only lock
A read-only lock on the storage account prevents any user, including those with Owner or Contributor roles, from deleting or modifying the resource. It still allows read operations, such as reading the backup data. This lock is the correct Azure governance feature to make a resource immutable and protect it from accidental or intentional deletion or changes.
D
Azure role-based access control (RBAC) with Reader role
Why wrong: Assigning the Reader role to all users would prevent them from making changes, but it does not protect the storage account from an administrator who has the Owner or Contributor role. Those higher-privileged roles include permissions to delete resources. A resource lock is required to override the Owner's permissions. Therefore, RBAC alone is insufficient.

Question 3mediummultiple choice

A multinational company has multiple Azure subscriptions for different business units. The central governance team wants to define a standardized environment that must be automatically applied to every new subscription. The standard must include a set of Azure Policy definitions (e.g., allowed regions), a specific Azure RBAC role assignment (e.g., a contributor access for a central security group), and a preconfigured resource group with a virtual network. The team wants to package all these components together so that they can be deployed consistently and updated centrally. Which Azure service should the team use?

Trap 1: Azure Policy

Azure Policy enforces rules and effects on resources but cannot deploy resource groups, virtual networks, or RBAC role assignments. It only applies policy definitions, not infrastructure resources.

Trap 2: Azure Management Groups

Azure Management Groups provide a hierarchical structure for applying policies and RBAC across subscriptions, but they do not deploy resources or create resource groups. They are used for governance inheritance, not for deploying a standardized environment.

Trap 3: Azure Resource Manager templates

ARM templates can deploy resources like resource groups and virtual networks, but they cannot natively include Azure Policy definitions or RBAC role assignments in a single packaged artifact. Combining all components would require additional orchestration outside of ARM templates.

A
Azure Blueprints
Azure Blueprints is the correct service because it allows you to define a repeatable set of Azure resources, policy definitions, and RBAC assignments that are deployed together as a blueprint assignment. It supports versioning and central updates across multiple subscriptions.
B
Azure Policy
Why wrong: Azure Policy enforces rules and effects on resources but cannot deploy resource groups, virtual networks, or RBAC role assignments. It only applies policy definitions, not infrastructure resources.
C
Azure Management Groups
Why wrong: Azure Management Groups provide a hierarchical structure for applying policies and RBAC across subscriptions, but they do not deploy resources or create resource groups. They are used for governance inheritance, not for deploying a standardized environment.
D
Azure Resource Manager templates
Why wrong: ARM templates can deploy resources like resource groups and virtual networks, but they cannot natively include Azure Policy definitions or RBAC role assignments in a single packaged artifact. Combining all components would require additional orchestration outside of ARM templates.

Question 4mediummultiple choice

A company manages hundreds of Azure SQL databases across multiple subscriptions. The compliance team requires that every Azure SQL database has diagnostic settings enabled to send logs to a central Log Analytics workspace. The team wants a solution that automatically configures diagnostic settings for any new Azure SQL database when it is created, without requiring manual intervention or additional scripting. Which Azure governance feature should the team use?

Trap 1: Azure Blueprints with a resource group artifact

While Blueprints can define policy assignments, the automatic remediation at resource creation time is a feature of the policy effect (DeployIfNotExists) itself, not the Blueprint artifact. Blueprints do not directly deploy configurations to new resources independently.

Trap 2: Azure Resource Manager templates deployed via Azure DevOps

ARM templates deployed via Azure DevOps are an imperative deployment mechanism: a pipeline must be explicitly triggered (by a commit, a schedule, or manual approval) before any template runs. When a developer creates an Azure SQL database directly in the portal, via the CLI, or through any non-template path, no template is automatically executed. Even a well-designed CI/CD pipeline cannot intercept arbitrary resource creation events, so this approach cannot guarantee diagnostic settings for every new database without additional manual or event-driven wiring.

Trap 3: Azure Monitor with a data collection rule

Azure Monitor data collection rules (DCRs) are designed specifically for the Azure Monitor Agent (AMA) to govern telemetry collection on virtual machines, not for Azure SQL database resource-level diagnostic settings. SQL database diagnostic logs are configured using a dedicated 'Diagnostic settings' blade or an ARM template, which routes logs to Log Analytics, Event Hubs, or Storage. A DCR cannot target a PaaS resource like SQL DB, and it has no built-in enforcement mechanism to apply settings automatically at creation, so this option fails the requirement.

A
Azure Policy with the DeployIfNotExists effect
Azure Policy's DeployIfNotExists effect is evaluated during resource creation and update operations, and if the SQL database lacks diagnostic settings, the policy engine automatically deploys the linked ARM template to configure them. This happens without human intervention because the policy is assigned at a management group or subscription scope and the effect is an immutable part of the policy definition. It also provides a compliance dashboard, remediation tasks, and can be extended to existing databases.
B
Azure Blueprints with a resource group artifact
Why wrong: While Blueprints can define policy assignments, the automatic remediation at resource creation time is a feature of the policy effect (DeployIfNotExists) itself, not the Blueprint artifact. Blueprints do not directly deploy configurations to new resources independently.
C
Azure Resource Manager templates deployed via Azure DevOps
Why wrong: ARM templates deployed via Azure DevOps are an imperative deployment mechanism: a pipeline must be explicitly triggered (by a commit, a schedule, or manual approval) before any template runs. When a developer creates an Azure SQL database directly in the portal, via the CLI, or through any non-template path, no template is automatically executed. Even a well-designed CI/CD pipeline cannot intercept arbitrary resource creation events, so this approach cannot guarantee diagnostic settings for every new database without additional manual or event-driven wiring.
D
Azure Monitor with a data collection rule
Why wrong: Azure Monitor data collection rules (DCRs) are designed specifically for the Azure Monitor Agent (AMA) to govern telemetry collection on virtual machines, not for Azure SQL database resource-level diagnostic settings. SQL database diagnostic logs are configured using a dedicated 'Diagnostic settings' blade or an ARM template, which routes logs to Log Analytics, Event Hubs, or Storage. A DCR cannot target a PaaS resource like SQL DB, and it has no built-in enforcement mechanism to apply settings automatically at creation, so this option fails the requirement.

Question 5mediummultiple choice

A healthcare organization needs to enforce a set of compliance requirements (e.g., enable encryption on all storage accounts, restrict public network access to SQL databases, and enforce a specific TLS version) across all Azure subscriptions. The organization has defined these requirements as individual Azure Policy definitions. The governance team wants to assign all these policies together as a single unit to a management group, ensuring that any new subscription created under that group automatically receives all the policies. Which Azure object should the governance team create first?

Trap 1: Azure Blueprint

Incorrect. An Azure Blueprint is used to orchestrate the deployment of a complete environment, including policies, role assignments, and resource templates. While it can include policies, the scenario already has individual policies defined; creating a blueprint would add unnecessary complexity and is not the primary object needed to simply group existing policies for assignment.

Trap 2: Azure Management Group

Incorrect. A management group is a container that helps manage access, policies, and compliance across multiple subscriptions. It serves as a scope where policies or initiatives can be assigned, but it is not the object that groups policies together. The governance team must first create the initiative to group the policies, then assign the initiative to the management group.

Trap 3: Azure Resource Manager template

Incorrect. An Azure Resource Manager (ARM) template is a JSON file used for deploying Azure resources declaratively. It does not group policy definitions for assignment; it is used for infrastructure as code. For grouping policies, an Azure Policy initiative is the appropriate object.

A
Azure Policy initiative
Correct. An Azure Policy initiative (policy set definition) groups related individual policy definitions into a single unit that can be assigned at scale. This allows the organization to enforce all compliance requirements together consistently across subscriptions.
B
Azure Blueprint
Why wrong: Incorrect. An Azure Blueprint is used to orchestrate the deployment of a complete environment, including policies, role assignments, and resource templates. While it can include policies, the scenario already has individual policies defined; creating a blueprint would add unnecessary complexity and is not the primary object needed to simply group existing policies for assignment.
C
Azure Management Group
Why wrong: Incorrect. A management group is a container that helps manage access, policies, and compliance across multiple subscriptions. It serves as a scope where policies or initiatives can be assigned, but it is not the object that groups policies together. The governance team must first create the initiative to group the policies, then assign the initiative to the management group.
D
Azure Resource Manager template
Why wrong: Incorrect. An Azure Resource Manager (ARM) template is a JSON file used for deploying Azure resources declaratively. It does not group policy definitions for assignment; it is used for infrastructure as code. For grouping policies, an Azure Policy initiative is the appropriate object.

Question 6mediummultiple choice

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

Trap 1: Azure Resource Graph

Incorrect. Azure Resource Graph is a query service that allows you to explore and discover resources across subscriptions. It can report on which resources are missing tags, but it cannot automatically apply or enforce tag inheritance. It is a read-only tool.

Trap 2: Azure Management Groups

Incorrect. Management Groups provide a hierarchical structure for organizing subscriptions and applying policies or RBAC at scale. However, they do not directly perform tag inheritance. The actual tag inheritance is achieved by assigning an Azure Policy definition to a management group or subscription scope; the management group itself is not the enforcement mechanism.

Trap 3: Azure Tags (manual tagging feature)

Incorrect. While Azure Tags are key-value pairs used for metadata and cost tracking, the manual tagging feature only allows users to apply tags manually or via scripts. It does not automatically inherit tags from the resource group. The governance team needs an automated enforcement tool, which is Azure Policy.

A
Azure Policy with the 'Inherit a tag from the resource group if missing' effect
Correct. Azure Policy includes built-in effects (e.g., modify, append) that can automatically apply or inherit tags. The 'Inherit a tag from the resource group if missing' effect copies the resource group's tag value to resources that do not already have that tag, ensuring automatic compliance.
B
Azure Resource Graph
Why wrong: Incorrect. Azure Resource Graph is a query service that allows you to explore and discover resources across subscriptions. It can report on which resources are missing tags, but it cannot automatically apply or enforce tag inheritance. It is a read-only tool.
C
Azure Management Groups
Why wrong: Incorrect. Management Groups provide a hierarchical structure for organizing subscriptions and applying policies or RBAC at scale. However, they do not directly perform tag inheritance. The actual tag inheritance is achieved by assigning an Azure Policy definition to a management group or subscription scope; the management group itself is not the enforcement mechanism.
D
Azure Tags (manual tagging feature)
Why wrong: Incorrect. While Azure Tags are key-value pairs used for metadata and cost tracking, the manual tagging feature only allows users to apply tags manually or via scripts. It does not automatically inherit tags from the resource group. The governance team needs an automated enforcement tool, which is Azure Policy.

Question 7mediummultiple choice

A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Trap 1: Create a second policy assignment at the sandbox subscription with…

Azure Policy does not support a 'Disabled' effect. You cannot override a parent policy assignment by assigning the same policy with a different effect at a child scope. The only way to exclude a scope from a policy assignment is to use an exemption.

Trap 2: Remove the policy assignment from the management group and assign…

This approach is extremely inefficient and error-prone for 30 subscriptions. It defeats the purpose of using a management group to apply policy centrally. The correct method is to keep the management group assignment and use an exemption for the sandbox.

Trap 3: Configure an Azure Blueprint for the management group and exclude…

Azure Blueprints can include policy assignments, but they do not have a built-in exclusion mechanism. To exclude a subscription from a blueprint's policy assignment, you would still need to create an exemption on that subscription. Additionally, moving from a direct policy assignment to a blueprint is unnecessary complexity.

A
Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.
Why wrong: Azure Policy does not support a 'Disabled' effect. You cannot override a parent policy assignment by assigning the same policy with a different effect at a child scope. The only way to exclude a scope from a policy assignment is to use an exemption.
B
Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.
Why wrong: This approach is extremely inefficient and error-prone for 30 subscriptions. It defeats the purpose of using a management group to apply policy centrally. The correct method is to keep the management group assignment and use an exemption for the sandbox.
C
Use a policy exemption on the sandbox subscription with category 'Waiver'.
Correct. A policy exemption allows you to exclude a scope from an existing policy assignment. The 'Waiver' category is appropriate for a planned, temporary exemption where the scope is not expected to comply, such as a development sandbox.
D
Configure an Azure Blueprint for the management group and exclude the sandbox subscription.
Why wrong: Azure Blueprints can include policy assignments, but they do not have a built-in exclusion mechanism. To exclude a subscription from a blueprint's policy assignment, you would still need to create an exemption on that subscription. Additionally, moving from a direct policy assignment to a blueprint is unnecessary complexity.

Question 8mediummultiple choice

A company has a critical Azure resource group that contains all production virtual machines and databases. The IT security administrator wants to ensure that no user, including members of the 'Owner' role, can accidentally or intentionally delete this resource group. The solution must not prevent modification of resources inside the resource group. The administrator needs to apply a governance control at the resource group level. What should the administrator do?

Trap 1: Apply a 'ReadOnly' lock on the resource group.

A 'ReadOnly' lock enforces read-only access to all resources within the scope by preventing any create, update, or delete operations for all users, including the Owner role. While it does block the resource group from being deleted, it also prevents legitimate modifications to production resources—such as configuration updates, scaling operations, or applying patches—which are required for ongoing operations. Therefore, it is overly restrictive and does not meet the requirement of allowing changes while only prohibiting deletion.

Trap 2: Assign a custom RBAC role that denies delete actions at the…

While a custom RBAC role can deny delete actions, it is not a foolproof governance control. Users with elevated roles (such as Owner) might override the deny assignment, or the assignment could be changed by other administrators. Azure Resource Locks provide a stronger enforcement that overrides RBAC permissions.

Trap 3: Move the resource group to a separate subscription with billing…

Moving the resource group to a different subscription does not inherently prevent deletion. Users with administrative access to that subscription could still delete the resource group. This action does not provide the required protection against deletion.

A
Apply a 'ReadOnly' lock on the resource group.
Why wrong: A 'ReadOnly' lock enforces read-only access to all resources within the scope by preventing any create, update, or delete operations for all users, including the Owner role. While it does block the resource group from being deleted, it also prevents legitimate modifications to production resources—such as configuration updates, scaling operations, or applying patches—which are required for ongoing operations. Therefore, it is overly restrictive and does not meet the requirement of allowing changes while only prohibiting deletion.
B
Apply a 'CanNotDelete' lock on the resource group.
A 'CanNotDelete' lock allows read and update operations but blocks delete operations on the resource group. This lock applies to all users, including those with the Owner role, making it the correct governance control to prevent accidental or intentional deletion while allowing modifications.
C
Assign a custom RBAC role that denies delete actions at the resource group scope.
Why wrong: While a custom RBAC role can deny delete actions, it is not a foolproof governance control. Users with elevated roles (such as Owner) might override the deny assignment, or the assignment could be changed by other administrators. Azure Resource Locks provide a stronger enforcement that overrides RBAC permissions.
D
Move the resource group to a separate subscription with billing separation.
Why wrong: Moving the resource group to a different subscription does not inherently prevent deletion. Users with administrative access to that subscription could still delete the resource group. This action does not provide the required protection against deletion.

Question 9mediummultiple choice

A company has a root management group that contains all Azure subscriptions. A centralized governance team needs to create and assign Azure Policy definitions and set initiatives that apply to all subscriptions. Which built-in role should be assigned to the governance team at the root management group scope to grant the minimum required permissions?

Trap 1: Owner

Owner grants full access to manage all resources, including the ability to delegate access to others. This is excessive for a team that only needs to manage policies and does not meet the 'minimum required permissions' requirement.

Trap 2: Contributor

Contributor is a built-in RBAC role that grants full management rights over all resources and resource groups, including the ability to create, update, and delete them, but it cannot delegate access or manage role assignments. For a team whose sole responsibility is creating and editing Azure Policy definitions, initiatives, and assignments, Contributor is over-permissive because it allows actions such as modifying virtual machines, storage accounts, or network configurations—operations completely unrelated to policy governance. This violates the principle of least privilege, which demands granting only the specific permissions necessary to perform required tasks, and could lead to unintended configuration changes or data exposure if a policy administrator makes a mistake.

Trap 3: Security Admin

Security Admin provides permissions to manage security policies in Microsoft Defender for Cloud and other security features, but it does not grant the ability to create or manage Azure Policy definitions and assignments directly. It is not the correct role for this governance task.

A
Owner
Why wrong: Owner grants full access to manage all resources, including the ability to delegate access to others. This is excessive for a team that only needs to manage policies and does not meet the 'minimum required permissions' requirement.
B
Contributor
Why wrong: Contributor is a built-in RBAC role that grants full management rights over all resources and resource groups, including the ability to create, update, and delete them, but it cannot delegate access or manage role assignments. For a team whose sole responsibility is creating and editing Azure Policy definitions, initiatives, and assignments, Contributor is over-permissive because it allows actions such as modifying virtual machines, storage accounts, or network configurations—operations completely unrelated to policy governance. This violates the principle of least privilege, which demands granting only the specific permissions necessary to perform required tasks, and could lead to unintended configuration changes or data exposure if a policy administrator makes a mistake.
C
Policy Contributor
Policy Contributor is designed specifically for managing Azure Policy resources. It allows creating, updating, and deleting policy definitions, initiatives, and assignments. At the root management group scope, this role enables policy governance across all subscriptions without granting broader management capabilities.
D
Security Admin
Why wrong: Security Admin provides permissions to manage security policies in Microsoft Defender for Cloud and other security features, but it does not grant the ability to create or manage Azure Policy definitions and assignments directly. It is not the correct role for this governance task.

Question 10mediummultiple choice

A multinational company has a strict data residency requirement: all Azure virtual machines must be deployed only in the East US or West Europe Azure regions. The IT governance team wants to enforce this rule automatically so that any attempt to create a virtual machine in any other region is blocked immediately at the time of deployment. Users must receive a clear error message if they try to create a VM in a disallowed region. Which Azure feature should the governance team configure to meet this requirement?

Trap 1: Create a resource lock on the subscription to prevent all resource…

Resource locks (CanNotDelete or ReadOnly) are designed to protect resources from accidental deletion or modification, not to block the creation of new resources. A resource lock on the subscription would prevent deletion of the subscription itself, but it does not block deployments of virtual machines in disallowed regions.

Trap 2: Assign an Azure RBAC role that denies create permissions for VMs in…

Azure RBAC roles manage permissions based on actions (e.g., Microsoft.Compute/virtualMachines/write) but cannot easily restrict by resource property such as region. Even with a custom role, you would need to specify each disallowed region in NotActions, which is cumbersome and error-prone. Azure Policy is the correct service for rules based on resource properties.

Trap 3: Set up a budget alert in Cost Management to notify when a VM is…

Setting up a budget alert in Azure Cost Management is fundamentally a financial monitoring mechanism, not a governance or enforcement tool. It triggers notifications when usage or spending exceeds configured thresholds, but it cannot inspect the region of a newly created VM, nor can it intercept or block the deployment request. Because budget data is aggregated and refreshed on a delay, the alert would only notify you after the fact—if at all—and it would not provide any information about which specific resource or why it is non-compliant. This makes it a purely reactive, post-deployment observation method that cannot satisfy a strict data residency requirement.

A
Create a resource lock on the subscription to prevent all resource creation.
Why wrong: Resource locks (CanNotDelete or ReadOnly) are designed to protect resources from accidental deletion or modification, not to block the creation of new resources. A resource lock on the subscription would prevent deletion of the subscription itself, but it does not block deployments of virtual machines in disallowed regions.
B
Configure an Azure Policy with the Deny effect assigned to the subscription scope.
Azure Policy with the Deny effect evaluates resource creation or update requests and denies them if they do not comply with the policy rules (e.g., VM location). The denial includes a clear error message explaining which policy prevented the action. This is the standard method to enforce location restrictions proactively.
C
Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.
Why wrong: Azure RBAC roles manage permissions based on actions (e.g., Microsoft.Compute/virtualMachines/write) but cannot easily restrict by resource property such as region. Even with a custom role, you would need to specify each disallowed region in NotActions, which is cumbersome and error-prone. Azure Policy is the correct service for rules based on resource properties.
D
Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.
Why wrong: Setting up a budget alert in Azure Cost Management is fundamentally a financial monitoring mechanism, not a governance or enforcement tool. It triggers notifications when usage or spending exceeds configured thresholds, but it cannot inspect the region of a newly created VM, nor can it intercept or block the deployment request. Because budget data is aggregated and refreshed on a delay, the alert would only notify you after the fact—if at all—and it would not provide any information about which specific resource or why it is non-compliant. This makes it a purely reactive, post-deployment observation method that cannot satisfy a strict data residency requirement.

Question 11mediummultiple choice

A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?

Trap 1: Append

Incorrect. The Append effect can add additional fields to a resource during creation or update, and it can be used for tags. However, it does not support modifying existing tags or running remediation on existing resources. The Modify effect is the recommended and more capable choice for tags.

Trap 2: DeployIfNotExists

Incorrect. The DeployIfNotExists effect is used to deploy a resource (such as a diagnostic setting or a network security group) when a parent resource does not have it. It does not modify properties of existing resources like tags.

Trap 3: Audit

The Audit effect in Azure Policy is a non-compliant reporting mechanism: it evaluates resources against the policy definition and marks them as non-compliant in the compliance dashboard, but it takes no remediation action whatsoever. It cannot append or modify tags, nor can it deploy any configuration. Therefore, while Audit would alert you to resources missing the required tag, it would not enforce the policy or automatically add the tag, making it unsuitable for the stated requirement that 'all Azure resources must have a tag'.

A
Append
Why wrong: Incorrect. The Append effect can add additional fields to a resource during creation or update, and it can be used for tags. However, it does not support modifying existing tags or running remediation on existing resources. The Modify effect is the recommended and more capable choice for tags.
B
Modify
Correct. The Modify effect is designed to add, change, or remove tags and other properties on resources. It can be applied during resource creation or update and supports remediation tasks to bring existing non-compliant resources into compliance. This makes it the best fit for the scenario.
C
DeployIfNotExists
Why wrong: Incorrect. The DeployIfNotExists effect is used to deploy a resource (such as a diagnostic setting or a network security group) when a parent resource does not have it. It does not modify properties of existing resources like tags.
D
Audit
Why wrong: The Audit effect in Azure Policy is a non-compliant reporting mechanism: it evaluates resources against the policy definition and marks them as non-compliant in the compliance dashboard, but it takes no remediation action whatsoever. It cannot append or modify tags, nor can it deploy any configuration. Therefore, while Audit would alert you to resources missing the required tag, it would not enforce the policy or automatically add the tag, making it unsuitable for the stated requirement that 'all Azure resources must have a tag'.

Question 12mediummultiple choice

A company has multiple Azure subscriptions for different development teams. They need to define a repeatable environment that includes a set of Azure policies, role assignments, and resource templates that must be applied to any new subscription created for a project. Which Azure service should they use?

Trap 1: Azure Policy

Incorrect. Azure Policy enforces rules and effects on resources, but does not deploy resource templates or RBAC assignments.

Trap 2: Azure Resource Manager

Incorrect. Azure Resource Manager is the service for managing resources, but it does not package policies and roles as a single deployable unit.

Trap 3: Azure Management Groups

Incorrect. Management Groups organize subscriptions hierarchically for policy and access management, but they do not define the environment contents.

A
Azure Blueprints
Correct. Azure Blueprints allows declarative definition and orchestration of resources, policies, and roles for creating compliant environments.
B
Azure Policy
Why wrong: Incorrect. Azure Policy enforces rules and effects on resources, but does not deploy resource templates or RBAC assignments.
C
Azure Resource Manager
Why wrong: Incorrect. Azure Resource Manager is the service for managing resources, but it does not package policies and roles as a single deployable unit.
D
Azure Management Groups
Why wrong: Incorrect. Management Groups organize subscriptions hierarchically for policy and access management, but they do not define the environment contents.

Question 13mediummultiple choice

A company has a production Azure subscription used by multiple teams. The governance team wants to enforce a rule that only virtual machines (VMs) of specific SKU sizes (e.g., Standard_D2s_v3 and Standard_D4s_v3) can be deployed. If a team attempts to deploy a VM of a different SKU size, the deployment must be blocked immediately and the user must see an error message explaining the restriction. Which Azure feature should the governance team use?

Trap 1: Azure Role-Based Access Control (RBAC) with a custom role that…

This is incorrect because Azure RBAC controls who can perform actions on resources (authorization), but it does not evaluate the configuration or properties of the resource being created. A Deny assignment for the write action would block all VM creations, not just those with disallowed SKU sizes. RBAC is not designed for policy enforcement based on resource properties.

Trap 2: Azure Blueprints with a resource lock

Azure Blueprints is used to deploy a set of repeatable and governed environments, including policies, role assignments, and resource groups. However, a resource lock only prevents deletion or modification of existing resources; it does not block the creation of new resources with disallowed properties. Additionally, Blueprints alone cannot enforce a deny on SKU sizes without an accompanying Azure Policy.

Trap 3: Azure resource locks at the resource group level

Resource locks are used to prevent accidental deletion or modification of critical resources. A 'CanNotDelete' or 'ReadOnly' lock on a resource group would block all deletions or modifications, but it does not evaluate the properties of new resources being deployed. It cannot prevent the creation of a VM with a disallowed SKU size.

A
Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action
Why wrong: This is incorrect because Azure RBAC controls who can perform actions on resources (authorization), but it does not evaluate the configuration or properties of the resource being created. A Deny assignment for the write action would block all VM creations, not just those with disallowed SKU sizes. RBAC is not designed for policy enforcement based on resource properties.
B
Azure Policy with the 'Deny' effect
Azure Policy with the 'Deny' effect is the correct solution. A policy definition can specify allowed VM SKU sizes using conditions. When assigned to a scope (e.g., subscription or resource group), any deployment of a VM that does not comply with the condition is blocked before the resource is created. This is the appropriate service for enforcing rules on resource configuration.
C
Azure Blueprints with a resource lock
Why wrong: Azure Blueprints is used to deploy a set of repeatable and governed environments, including policies, role assignments, and resource groups. However, a resource lock only prevents deletion or modification of existing resources; it does not block the creation of new resources with disallowed properties. Additionally, Blueprints alone cannot enforce a deny on SKU sizes without an accompanying Azure Policy.
D
Azure resource locks at the resource group level
Why wrong: Resource locks are used to prevent accidental deletion or modification of critical resources. A 'CanNotDelete' or 'ReadOnly' lock on a resource group would block all deletions or modifications, but it does not evaluate the properties of new resources being deployed. It cannot prevent the creation of a VM with a disallowed SKU size.

Question 14mediummultiple choice

A large enterprise has multiple Azure subscriptions for different departments. The central IT team wants to enforce a policy that restricts the Azure regions where resources can be deployed. The policy must automatically apply to all existing subscriptions and to any new subscriptions created in the future, without requiring manual assignment to each subscription individually. Which Azure feature should the central IT team use to achieve this hierarchical governance?

Trap 1: Azure Blueprints

Incorrect. Azure Blueprints are used to define a repeatable set of Azure resources (like policies, RBAC, templates) for deploying environments, but they do not inherently automatically apply policies to all subscriptions in a hierarchy; they require explicit assignment and do not provide automatic cascading for new subscriptions.

Trap 2: Azure Resource Groups

Incorrect. Azure Resource Groups are logical containers used to organize and manage related resources, but each resource group is scoped to a single Azure subscription. They cannot span subscriptions or provide any inheritance mechanism, so assigning policies to a resource group only affects resources within that group, never across multiple subscriptions. Consequently, resource groups offer no capability for centralized, cascading policy enforcement across an enterprise's entire subscription hierarchy.

Trap 3: Azure Policy alone assigned to each subscription

Incorrect. While Azure Policy is the correct tool for enforcing rules, assigning it individually to each subscription does not automatically cover new subscriptions. This approach requires manual effort and does not achieve the desired hierarchical, automatic cascading effect.

A
Azure Management Groups
Correct. Management Groups allow you to assign Azure Policy at a high level (e.g., root management group) and have that policy automatically apply to all child subscriptions, including future subscriptions, ensuring consistent governance across the entire hierarchy.
B
Azure Blueprints
Why wrong: Incorrect. Azure Blueprints are used to define a repeatable set of Azure resources (like policies, RBAC, templates) for deploying environments, but they do not inherently automatically apply policies to all subscriptions in a hierarchy; they require explicit assignment and do not provide automatic cascading for new subscriptions.
C
Azure Resource Groups
Why wrong: Incorrect. Azure Resource Groups are logical containers used to organize and manage related resources, but each resource group is scoped to a single Azure subscription. They cannot span subscriptions or provide any inheritance mechanism, so assigning policies to a resource group only affects resources within that group, never across multiple subscriptions. Consequently, resource groups offer no capability for centralized, cascading policy enforcement across an enterprise's entire subscription hierarchy.
D
Azure Policy alone assigned to each subscription
Why wrong: Incorrect. While Azure Policy is the correct tool for enforcing rules, assigning it individually to each subscription does not automatically cover new subscriptions. This approach requires manual effort and does not achieve the desired hierarchical, automatic cascading effect.

Question 15mediummultiple choice

A company has a regulatory requirement that all Azure resources must be deployed only in the West Europe region. The governance team needs to automatically prevent any user or application from creating resources in any other region. The team must also ensure that this restriction is applied to all existing and future subscriptions within the tenant. Which Azure service should the governance team use?

Trap 1: Azure Blueprints

Incorrect. Azure Blueprints is used to define a repeatable set of Azure resources and policies that implement and adhere to standards and patterns. While a blueprint can include policy assignments, the enforcement of the region restriction is the job of the policy itself, not the blueprint. The question asks for the service that provides the enforcement, which is Azure Policy.

Trap 2: Management Groups

Incorrect. Management Groups are containers that help you manage access, policy, and compliance across multiple subscriptions. They organize subscriptions into a hierarchy but do not directly enforce restrictions on which regions resources can be deployed in.

Trap 3: Azure Role-Based Access Control (RBAC)

Incorrect. RBAC provides fine-grained access management for Azure resources, allowing you to grant specific permissions to users, groups, and applications. While you could potentially restrict 'Create' permissions for certain regions by creating custom roles, this is not straightforward and does not automatically enforce location constraints across all resource types. Azure Policy is the designed service for such resource property enforcement.

A
Azure Policy
Correct. Azure Policy allows you to create, assign, and manage policies that enforce different rules over your resources. The 'Allowed Locations' policy definition can be assigned at a management group scope to block creation of resources in regions other than West Europe, and this applies to all subscriptions under that scope.
B
Azure Blueprints
Why wrong: Incorrect. Azure Blueprints is used to define a repeatable set of Azure resources and policies that implement and adhere to standards and patterns. While a blueprint can include policy assignments, the enforcement of the region restriction is the job of the policy itself, not the blueprint. The question asks for the service that provides the enforcement, which is Azure Policy.
C
Management Groups
Why wrong: Incorrect. Management Groups are containers that help you manage access, policy, and compliance across multiple subscriptions. They organize subscriptions into a hierarchy but do not directly enforce restrictions on which regions resources can be deployed in.
D
Azure Role-Based Access Control (RBAC)
Why wrong: Incorrect. RBAC provides fine-grained access management for Azure resources, allowing you to grant specific permissions to users, groups, and applications. While you could potentially restrict 'Create' permissions for certain regions by creating custom roles, this is not straightforward and does not automatically enforce location constraints across all resource types. Azure Policy is the designed service for such resource property enforcement.

Question 16mediummultiple choice

A company has an Azure subscription with hundreds of existing virtual machines. The governance team wants to enforce a policy that every virtual machine must have a tag named 'CostCenter' with a valid value. The team wants to automatically add the 'CostCenter' tag with a default value of 'Undefined' to any existing or new virtual machine that is missing the tag. They do not want to block the creation of virtual machines that are missing the tag, but they do want the tag to be added automatically within a few minutes of detection. Which Azure Policy effect should the team use?

Trap 1: Audit

Audit merely evaluates resources against the policy definition and writes compliance details to the Azure activity log. For an existing VM missing the CostCenter tag, Audit would report it as non-compliant without ever modifying the VM, and new deployments would receive the same passive treatment. Since the requirement is to apply the tag automatically to both existing and new VMs, Audit provides no remediation action and leaves the resources untouched.

Trap 2: Deny

The Deny effect prevents creation or update of any non-compliant resource, so a VM without the CostCenter tag would be rejected rather than tagged. This directly contradicts the requirement to automatically add the tag, and it would also disrupt existing workflows that expect successful provisioning. Moreover, Deny does nothing to remediate already deployed VMs; it only blocks future non-compliant attempts, making it an enforcement tool, not an auto-tagging mechanism.

Trap 3: Append

The Append effect can add missing fields (like tags) during resource creation or update. However, it does not automatically apply to existing resources unless a manual remediation task is triggered. The scenario requires automatic application to existing resources without manual steps, making Modify a better fit.

A
Audit
Why wrong: Audit merely evaluates resources against the policy definition and writes compliance details to the Azure activity log. For an existing VM missing the CostCenter tag, Audit would report it as non-compliant without ever modifying the VM, and new deployments would receive the same passive treatment. Since the requirement is to apply the tag automatically to both existing and new VMs, Audit provides no remediation action and leaves the resources untouched.
B
Deny
Why wrong: The Deny effect prevents creation or update of any non-compliant resource, so a VM without the CostCenter tag would be rejected rather than tagged. This directly contradicts the requirement to automatically add the tag, and it would also disrupt existing workflows that expect successful provisioning. Moreover, Deny does nothing to remediate already deployed VMs; it only blocks future non-compliant attempts, making it an enforcement tool, not an auto-tagging mechanism.
C
Append
Why wrong: The Append effect can add missing fields (like tags) during resource creation or update. However, it does not automatically apply to existing resources unless a manual remediation task is triggered. The scenario requires automatic application to existing resources without manual steps, making Modify a better fit.
D
Modify
The Modify effect uses a defined role (via managed identity) to change resource properties on existing and new resources. It can automatically add the 'CostCenter' tag with a default value to both existing VMs (through remediation tasks that run automatically or on a schedule) and new VMs, fulfilling the requirement without blocking resource creation.

Question 17mediummultiple choice

Which Azure service allows customers to extend Azure management and governance to non-Azure resources, including on-premises servers and other cloud providers?

Trap 1: Azure Stack Hub

Azure Stack Hub is a fully integrated Azure environment that runs on certified, dedicated hardware in your own datacenter, essentially creating a separate Azure endpoint. While it works in disconnected scenarios, it does not manage already-existing external resources; you must deploy workloads on it. Azure Arc requires no special hardware or separate deployment, because a lightweight agent simply connects any existing on-premises or multi-cloud machine to Azure's standard management plane.

Trap 2: Azure ExpressRoute

Azure ExpressRoute is a private network connectivity service that links your on-premises network to Microsoft's cloud over a dedicated, high-bandwidth circuit. It provides only Layer 2/Layer 3 data connectivity; it cannot install agents, report resource configuration, or enable Azure management features on non-Azure machines. While ExpressRoute might be used to connect a network physically, Azure Arc is the technology that extends Azure's management plane to resources outside of Azure.

Trap 3: Azure VPN Gateway

Azure VPN Gateway establishes encrypted network tunnels between on-premises networks and Azure virtual networks, but it is purely a data-path connectivity service. It does not project external servers into Azure Resource Manager, so it cannot provide Azure Policy, RBAC, or centralized inventory for non-Azure resources. Arc, by contrast, installs an agent to register those resources with the Azure control plane.

A
Azure Stack Hub
Why wrong: Azure Stack Hub is a fully integrated Azure environment that runs on certified, dedicated hardware in your own datacenter, essentially creating a separate Azure endpoint. While it works in disconnected scenarios, it does not manage already-existing external resources; you must deploy workloads on it. Azure Arc requires no special hardware or separate deployment, because a lightweight agent simply connects any existing on-premises or multi-cloud machine to Azure's standard management plane.
B
Azure Arc
Azure Arc projects non-Azure resources, such as Windows and Linux servers, into Azure Resource Manager by installing the Connected Machine agent, which registers each machine as an Azure resource. Once registered, these resources appear in the Azure portal, can be controlled with Azure Policy, assigned RBAC permissions, and have guest configuration audited from Azure. This enables consistent governance and monitoring across on-premises, multi-cloud, and edge environments without moving workloads or requiring a separate Azure deployment.
C
Azure ExpressRoute
Why wrong: Azure ExpressRoute is a private network connectivity service that links your on-premises network to Microsoft's cloud over a dedicated, high-bandwidth circuit. It provides only Layer 2/Layer 3 data connectivity; it cannot install agents, report resource configuration, or enable Azure management features on non-Azure machines. While ExpressRoute might be used to connect a network physically, Azure Arc is the technology that extends Azure's management plane to resources outside of Azure.
D
Azure VPN Gateway
Why wrong: Azure VPN Gateway establishes encrypted network tunnels between on-premises networks and Azure virtual networks, but it is purely a data-path connectivity service. It does not project external servers into Azure Resource Manager, so it cannot provide Azure Policy, RBAC, or centralized inventory for non-Azure resources. Arc, by contrast, installs an agent to register those resources with the Azure control plane.

Question 18mediummultiple choice

Which Azure governance feature enables organizations to enforce that all virtual machines be tagged with a specific 'Owner' tag before deployment?

Trap 1: Azure RBAC with custom permissions

Azure RBAC custom role definitions control access by granting or denying specific actions, such as Microsoft.Resources/subscriptions/resourceGroups/write, to users, groups, or service principals at a particular scope. A custom role can be tailored to allow resource creation, but RBAC cannot inspect or enforce the properties of the created resource, like tag values, because that is not an action within a role's permission list. Only Azure Policy can evaluate the resource attributes during the authorization stage and reject a request that does not carry the mandatory Owner tag, so RBAC alone cannot meet this requirement.

Trap 2: Azure Resource Manager template validation

Azure Resource Manager template validation checks that a template is syntactically correct, follows the ARM schema, and references valid resource types, but it does not inspect the resource properties for compliance with corporate standards like mandatory tags. Preflight validation may also verify some deployment prerequisites, yet it never evaluates against Azure Policy definitions; policy evaluation occurs during the actual deployment and can reject the request even if the template is perfectly formatted. Therefore, template validation alone cannot block a resource from being created without an Owner tag, whereas Policy can.

Trap 3: Azure DevOps deployment gates

Azure DevOps deployment gates are a pipeline feature that pauses a deployment until manual approval or health-check conditions are satisfied, but they only apply to resources released through that specific pipeline. They do not intercept resource creation performed directly in the Azure portal, via CLI, PowerShell, or other automation tools. Azure Policy, by contrast, evaluates every Azure Resource Manager request at the control plane, so it enforces tag requirements universally across all deployment methods.

A
Azure RBAC with custom permissions
Why wrong: Azure RBAC custom role definitions control access by granting or denying specific actions, such as Microsoft.Resources/subscriptions/resourceGroups/write, to users, groups, or service principals at a particular scope. A custom role can be tailored to allow resource creation, but RBAC cannot inspect or enforce the properties of the created resource, like tag values, because that is not an action within a role's permission list. Only Azure Policy can evaluate the resource attributes during the authorization stage and reject a request that does not carry the mandatory Owner tag, so RBAC alone cannot meet this requirement.
B
Azure Policy with 'Require tag' in deny mode
Azure Policy with the 'require a tag' initiative and a deny effect actively evaluates every resource creation or update request through the Azure Resource Manager control plane before the resource is provisioned. If the resource does not include the required Owner tag, the policy blocks the operation and returns a policy violation message, ensuring that no non-compliant resource can exist. This enforcement is independent of the client used (portal, CLI, ARM template, Terraform), and it is the correct mechanism because it enforces tagging requirements at the organization's governance layer.
C
Azure Resource Manager template validation
Why wrong: Azure Resource Manager template validation checks that a template is syntactically correct, follows the ARM schema, and references valid resource types, but it does not inspect the resource properties for compliance with corporate standards like mandatory tags. Preflight validation may also verify some deployment prerequisites, yet it never evaluates against Azure Policy definitions; policy evaluation occurs during the actual deployment and can reject the request even if the template is perfectly formatted. Therefore, template validation alone cannot block a resource from being created without an Owner tag, whereas Policy can.
D
Azure DevOps deployment gates
Why wrong: Azure DevOps deployment gates are a pipeline feature that pauses a deployment until manual approval or health-check conditions are satisfied, but they only apply to resources released through that specific pipeline. They do not intercept resource creation performed directly in the Azure portal, via CLI, PowerShell, or other automation tools. Azure Policy, by contrast, evaluates every Azure Resource Manager request at the control plane, so it enforces tag requirements universally across all deployment methods.

Question 19easymultiple choice

A company wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically apply the tag to new resources, and also to existing resources that are missing it. Which Azure service should they use?

Trap 1: Azure Blueprints

Azure Blueprints is an orchestration tool for packaging Azure Policy assignments, RBAC roles, and ARM templates into a repeatable artifact for new deployments. While a blueprint can include a policy that adds costcenter tags, the blueprint itself does not evaluate or remediate existing resources after assignment. The enforcement behavior comes solely from the underlying Azure Policy definitions, not from the blueprint artifact.

Trap 2: Azure Resource Manager

Azure Resource Manager (ARM) is the deployment and management layer that handles how resources are provisioned, authenticated, and organized in resource groups. It does not contain a policy engine for auditing or remediating non‑compliant resources; ARM requests are subject to Azure Policy, but ARM itself does not enforce tagging rules. Policy evaluation happens alongside ARM operations, which is a key distinction.

Trap 3: Azure Cost Management

Azure Cost Management is designed for financial operations, not enforcement. It provides cost analysis, budgets, and recommendations for optimizing spend, and it can group or filter costs by tags (including costcenter), but it has no effect that can add, modify, or require a tag on resources. Tagging enforcement is a compliance action, not a cost-accounting function.

A
Azure Policy
Azure Policy is the correct service because it can audit, deny, or append compliance settings across existing and new resources. To enforce a costcenter tag, you define a policy with the `Append` effect (to add the tag if missing) or `DeployIfNotExists` with a remediation task, and assign it to a management group, subscription, or resource group. This is the native governance mechanism for enforcing resource properties like required tags.
B
Azure Blueprints
Why wrong: Azure Blueprints is an orchestration tool for packaging Azure Policy assignments, RBAC roles, and ARM templates into a repeatable artifact for new deployments. While a blueprint can include a policy that adds costcenter tags, the blueprint itself does not evaluate or remediate existing resources after assignment. The enforcement behavior comes solely from the underlying Azure Policy definitions, not from the blueprint artifact.
C
Azure Resource Manager
Why wrong: Azure Resource Manager (ARM) is the deployment and management layer that handles how resources are provisioned, authenticated, and organized in resource groups. It does not contain a policy engine for auditing or remediating non‑compliant resources; ARM requests are subject to Azure Policy, but ARM itself does not enforce tagging rules. Policy evaluation happens alongside ARM operations, which is a key distinction.
D
Azure Cost Management
Why wrong: Azure Cost Management is designed for financial operations, not enforcement. It provides cost analysis, budgets, and recommendations for optimizing spend, and it can group or filter costs by tags (including costcenter), but it has no effect that can add, modify, or require a tag on resources. Tagging enforcement is a compliance action, not a cost-accounting function.

Question 20mediummultiple choice

A company manages multiple Azure subscriptions for development, testing, and production environments. The governance team needs to ensure that every new subscription automatically includes a consistent baseline consisting of Azure Policy definitions, role assignments, and a predefined resource group structure. The team wants to package these governance components into a single deployable artifact that can be applied to any subscription with minimal manual effort. Which Azure feature should the team use?

Trap 1: Azure Policy

Azure Policy is used to enforce organizational standards and to assess compliance at scale. However, it only applies policy rules and does not deploy role assignments or resource groups as part of a single package.

Trap 2: Azure Resource Manager (ARM) templates

ARM templates are Infrastructure as Code (IaC) files that define the resources to deploy, but they do not natively include Azure Policy assignments or role assignments. While you can embed some policies and roles using nested deployments, ARM templates lack the structured versioning and built-in governance packaging that Azure Blueprints provides.

Trap 3: Azure Management Groups

Azure Management Groups manage access, policies, and compliance across multiple subscriptions at scale by organizing them hierarchically. However, they do not create or deploy a package of governance components; they only serve as a container for subscriptions and inherited policies.

A
Azure Blueprints
Azure Blueprints allows you to define a repeatable set of Azure resources, policies, and role assignments that implement and adhere to an organization's standards, patterns, and requirements. A blueprint can be assigned to a subscription to create a consistent environment.
B
Azure Policy
Why wrong: Azure Policy is used to enforce organizational standards and to assess compliance at scale. However, it only applies policy rules and does not deploy role assignments or resource groups as part of a single package.
C
Azure Resource Manager (ARM) templates
Why wrong: ARM templates are Infrastructure as Code (IaC) files that define the resources to deploy, but they do not natively include Azure Policy assignments or role assignments. While you can embed some policies and roles using nested deployments, ARM templates lack the structured versioning and built-in governance packaging that Azure Blueprints provides.
D
Azure Management Groups
Why wrong: Azure Management Groups manage access, policies, and compliance across multiple subscriptions at scale by organizing them hierarchically. However, they do not create or deploy a package of governance components; they only serve as a container for subscriptions and inherited policies.