AZ-305 Practice Question 1: Governance Data Residency Scope
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 1 · question 1 of 10
Contoso Financial has 40 Azure subscriptions in a single Microsoft Entra tenant, and the platform team expects to add roughly one subscription per month as new business units onboard. An EU regulator requires that every Azure resource the company deploys be created only in EU regions.
You must design a governance solution that blocks non-compliant deployments, applies automatically to subscriptions created in the future, and requires the least ongoing administrative effort. What should you include in the design?
Show answer and explanation
Answer:
Azure Policy assignments are inherited by every child scope, so a single assignment made at a management group flows down to all subscriptions, resource groups, and resources beneath it, including subscriptions moved into the hierarchy later. The built-in Allowed locations definition uses the deny effect, which stops a non-compliant create or update request outright. One assignment, permanent coverage: that is the least-effort design that actually enforces.
Option A fails on two counts. The audit effect only records non-compliance in the compliance dashboard; it never blocks a deployment. And 40 separate assignments must be repeated by hand for every new subscription, which is the opposite of low effort.
Option B confuses governance with detection. Azure RBAC controls *who* may perform an action, not *what* the resulting resource looks like, and Reader grants no enforcement power at all. A weekly human review also detects violations only after the regulated data is already in the wrong region.
Option D addresses a different risk. Resource locks prevent deletion or modification of resources that already exist; they place no constraint on the region a new resource is deployed to. Tags are metadata and are not enforcement unless a policy evaluates them.
Reference: Overview of Azure Policy