AZ-305 Practice Question 62: Landing Zone Management Groups
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 7 · question 2 of 10
An enterprise is designing its management group hierarchy for an Azure landing zone. Shared services (identity, connectivity, management) need their own policies and access. Application workloads fall into two kinds: corporate apps that connect privately to the on-premises network, and online apps that face the internet. Some policies must apply to all workloads, and others (for example, denying public IP addresses) only to corporate apps.
Which hierarchy should you design?
Show answer and explanation
Answer:
The Azure landing zone reference architecture uses an intermediate root management group, a Platform group for the shared services, and a Landing zones group for workloads, with Corp and Online groups below it. Policy and role assignments are inherited, so organization-wide policies go at the intermediate root, workload-wide policies on Landing zones, and the public IP denial only on Corp.
Option B mirrors the organization chart. That produces many groups with duplicated policy assignments and no place to apply a policy once for all workloads.
Option C separates by lifecycle stage but mixes corporate and online workloads, so the policy that only applies to corporate apps could not be scoped correctly.
Option D removes the governance boundaries. A single subscription hits scale limits, and policies and access could only be varied by resource group.
Reference: Management groups in Azure landing zones