Task 1.3: Design governance

• AOne management group for each department, with subscriptions per team below it

  Incorrect

  Department hierarchies break with reorganizations, and the guidance recommends grouping by archetype instead.

• BA deep hierarchy eight levels below the root group that mirrors regions, departments and every environment

  Incorrect

  Deep trees add complexity and exceed the six levels of depth that management groups support below the root.

• CAll subscriptions directly under the tenant root group, with policies on each subscription

  Incorrect

  Assigning everything per subscription repeats policy work and loses inheritance by archetype.

• DPlatform and Landing zones groups under one root group, with Corp and Online under Landing zones

  Correct

  The recommended hierarchy separates platform subscriptions from landing zones and groups landing zones by archetype, not by org chart.

The Cloud Adoption Framework recommends a flat hierarchy: a top-level group under the tenant root, a Platform group for identity, management and connectivity subscriptions, and a Landing zones group with archetypes such as Corp and Online, plus Sandbox and Decommissioned.

• AA policy with the deny effect that requires the costCenter tag on every new or updated resource

  Incorrect

  Deny blocks deployments that lack the tag, which the requirement forbids, and doesn't fix existing resources.

• BA CanNotDelete lock on each resource group

  Incorrect

  Locks prevent deletion or changes; they don't set tags.

• CAn audit policy that reports resources without the tag

  Incorrect

  Audit only reports non-compliance; it doesn't add the tag.

• DThe built-in inherit-tag-from-resource-group policy, plus a remediation task

  Correct

  Its modify effect adds the tag on create or update, and a remediation task fixes resources that already exist.

Tags aren't inherited from resource groups by default. The Modify effect in a built-in tag inheritance policy adds or replaces tags during create and update, and a remediation task applies it to existing resources using the assignment's managed identity.

• APermanent Owner assignments reviewed every quarter by an access review

  Incorrect

  Reviews remove stale access later; the role would still be active all the time.

• BA custom role with the same permissions as Owner, assigned permanently

  Incorrect

  A custom role doesn't make access just-in-time or add approval.

• CA Conditional Access policy that requires MFA for the engineers

  Incorrect

  MFA strengthens sign-in but leaves the Owner role active at all times.

• DEligible Owner assignments in PIM with approval and a four-hour limit

  Correct

  PIM makes users eligible and activates the role on request, for a set duration, with approval and an audit history.

Privileged Identity Management provides just-in-time, time-bound and approval-based activation of Microsoft Entra and Azure roles, with justification, notifications and audit history.

• ACustom policy definitions written for each ISO 27001 control and assigned per subscription

  Incorrect

  Built-in initiatives already map to the standard; writing them all by hand is the most custom work.

• BTag every resource with the ISO 27001 controls it supports

  Incorrect

  Tags record metadata; they don't evaluate compliance.

• CThe ISO 27001 standard in the Defender for Cloud regulatory compliance dashboard

  Correct

  Defender for Cloud assigns the standard's built-in initiative and maps assessment results to the standard's controls.

• DAn Azure Monitor workbook that counts resources by type

  Incorrect

  Counting resources doesn't evaluate them against controls.

Regulatory compliance in Defender for Cloud assesses resources against standards such as ISO 27001 through built-in Azure Policy initiatives and shows per-control results in a dashboard that you can report from.

• AA recurring access review of guest users in the groups and apps, with managers of users as reviewers

  Correct

  Access reviews can target guest users only and recur quarterly with chosen reviewers.

• BA Privileged Identity Management eligible assignment for each guest

  Incorrect

  PIM controls role activation; it doesn't ask managers to confirm guest access every quarter.

• CA Conditional Access policy that blocks guests from untrusted locations

  Incorrect

  Location blocks don't make anyone confirm that access is still needed.

• DA dynamic group rule that adds every guest to a single group

  Incorrect

  A dynamic group gathers guests but never removes access that is no longer needed.

• EAuto apply results with the action for not reviewed set to remove access

  Correct

  Auto apply removes denied users, and the If reviewers don't respond setting can remove users nobody reviewed.

Access reviews in Microsoft Entra ID Governance recertify membership of groups and access to apps. A recurring review scoped to guests, with auto apply and the not-reviewed action set to remove access, removes access that nobody confirms.

• AA Waiver-category policy exemption on that account, with an expiration date

  Correct

  An exemption removes one resource from evaluation, records why, and stops applying when its expiration date passes.

• BEnforcement mode set to DoNotEnforce on the assignment for 60 days

  Incorrect

  That stops enforcing the policy for every resource in the scope, not just one account.

• CThe storage account's resource group added to the assignment's excluded scopes

  Incorrect

  An exclusion has no expiry and could cover other accounts in that resource group.

• DA CanNotDelete lock on the storage account

  Incorrect

  A lock prevents deletion; it doesn't let the account bypass a deny policy.

Policy exemptions exclude a resource hierarchy or an individual resource from an assignment, with a category (Waiver or Mitigated), a reason and an optional expiration date after which the exemption no longer applies.

• AA PowerShell script that calls Get-AzResource in each subscription

  Incorrect

  Looping through 180 subscriptions is the slow scripting the review wants to avoid.

• BThe activity log of each subscription filtered on write operations

  Incorrect

  The activity log records operations from the last 90 days, not the current state of every resource.

• CAzure Resource Graph queries run across the tenant's subscriptions

  Correct

  Resource Graph queries resource properties across subscriptions with KQL at scale, which suits inventory and tag reports.

• DCost Management exports grouped by resource

  Incorrect

  Cost exports cover resources that incurred charges and don't list properties such as missing tags for every resource type.

Azure Resource Graph lets you explore resources with complex queries across subscriptions and management groups, quickly and at scale, which makes it the tool for inventory and governance reporting.

• AA dynamic group for guests from the partner's domain, added to each resource

  Incorrect

  A dynamic group needs the guests to exist already and has no approval or expiry.

• BA bulk B2B invitation every quarter from a CSV that the partner sends

  Incorrect

  Bulk invites are the one-by-one onboarding work to avoid and give no approval or expiry.

• CPrivileged Identity Management eligible assignments for the partner's users

  Incorrect

  PIM governs activation of privileged roles, not self-service requests for a bundle of collaboration resources.

• DAn access package with the partner set up as a connected organization

  Correct

  Access packages bundle resources, let connected organizations' users request them, and handle approval, expiry and guest removal.

Entitlement management packages groups, apps and sites into access packages with policies for who can request, approval, expiration and access reviews. Connected organizations let users from partner directories request them, and guests can be removed when access ends.

• AThe Allowed locations built-in policy assigned at the management group

  Correct

  Allowed locations denies resources outside the listed regions, and an assignment at the management group covers every subscription under it.

• BThe Allowed locations policy assigned to each subscription by a script

  Incorrect

  Per-subscription assignments miss subscriptions created later unless someone reruns the script.

• CA tag named region required on every resource

  Incorrect

  A tag value doesn't control where a resource is deployed.

• DAn Azure Monitor alert on resource creation outside the two regions

  Incorrect

  An alert notices after deployment; it doesn't block it.

The Allowed locations built-in definition restricts the regions where resources can be deployed by denying others. Assigning it at a management group makes every subscription below inherit it.