AZ-305 · Question 13 · Domain 1.3: Governance

You are designing an Azure Landing Zone architecture for a multinational corporation. The company uses a 'Subscription Vending Machine' process to automatically provision new subscriptions for application teams.

The security team requires that every new subscription automatically has Microsoft Defender for Cloud enabled, specific Azure Policies assigned, and a standard VNet deployed and peered to the central Hub VNet.

Which Azure native approach provides the most scalable and declarative way to achieve this during the subscription creation process?