ExpertAZ-305 · Question 13 · Domain 1.3: Governance
You are designing an Azure Landing Zone architecture for a multinational corporation. The company uses a 'Subscription Vending Machine' process to automatically provision new subscriptions for application teams.
The security team requires that every new subscription automatically has Microsoft Defender for Cloud enabled, specific Azure Policies assigned, and a standard VNet deployed and peered to the central Hub VNet.
Which Azure native approach provides the most scalable and declarative way to achieve this during the subscription creation process?
You are designing an Azure Landing Zone architecture for a multinational corporation. The company uses a 'Subscription Vending Machine' process to automatically provision new subscriptions for application teams.
The security team requires that every new subscription automatically has Microsoft Defender for Cloud enabled, specific Azure Policies assigned, and a standard VNet deployed and peered to the central Hub VNet.
Which Azure native approach provides the most scalable and declarative way to achieve this during the subscription creation process?
Answer options:
Azure Blueprints
Azure Bicep with Management Group scope deployments.
Azure Automation Runbooks triggered by an Event Grid subscription.
Azure Policy with 'DeployIfNotExists' effects for the VNet peering.
How to approach this question
Full Answer
Common mistakes
Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 5
55 questions · hints · full answers · grading