Medium1 markMultiple Choice
Domain 1.3: Design GovernanceGovernanceAzure PolicyCompliance

AZ-305 · Question 15 · Domain 1.3: Design Governance

Your company is expanding its Azure footprint to Europe. Due to strict GDPR requirements, you must ensure that no Azure resources can be deployed outside of the 'West Europe' and 'North Europe' regions for a specific set of subscriptions.

You need to design a governance solution to enforce this requirement. The solution must automatically prevent non-compliant deployments and provide a dashboard showing compliance status.

Which TWO components should you include in your design? (Select TWO)

Answer options:

A.

Azure Policy with an 'Audit' effect.

B.

Azure Policy with a 'Deny' effect.

C.

Azure Role-Based Access Control (RBAC) custom roles.

D.

An Azure Policy assignment scoped to the European Management Group.

E.

Azure Resource Locks.

How to approach this question

Identify the tool for enforcing rules (Azure Policy), the effect needed to block actions (Deny), and the best scope for multiple subscriptions (Management Group).

Full Answer

Azure Policy with a 'Deny' effect, An Azure Policy assignment scoped to the European Management Group
Azure Policy is the governance tool used to enforce rules on resource deployments. To prevent deployments outside specific regions, a policy with the 'Deny' effect must be used. To apply this efficiently across multiple subscriptions, the policy should be assigned at the Management Group scope. Azure Policy automatically provides a compliance dashboard.

Common mistakes

Choosing RBAC. RBAC is for authorization (can user X create a VM?), while Policy is for governance (can a VM be created in region Y?).

Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 4

55 questions · hints · full answers · grading

More questions from this exam