AZ-305 Guide Path 2 · Module 1 · Design governance

Path 2 · Module 1

Design governance

📖 Microsoft Learn ~49 min❓ Quiz 21 questions✍ Design exercise 25 min

Read the module on Microsoft Learn, then come back here: test yourself with the quiz and apply it in the design exercise. Write down what you want to remember with the ✎ Note buttons.

Step 1 · Read the module

Open Design governance on Microsoft Learn. The units:

  1. Introduction
  2. Design for governance
  3. Design for management groups
  4. Design for subscriptions
  5. Design for resource groups
  6. Design for resource tags
  7. Design for Azure Policy
  8. Design for role-based access control (RBAC)
  9. Design for Azure landing zones
  10. Module assessment
  11. Summary and resources
Before you start the quiz

Close the Learn tab. Answering from memory is what makes it stick; looking it up just measures how fast you can scroll.

Part A

Quiz

21 exam-style questions, roughly in the order of the units. Click an answer to see the explanation. Your best score is saved and shown on the path page; use Retry at the end to go again.

1. What sits at the very top of the Azure governance hierarchy?

A. The tenant root group contains every management group and subscription in the Entra tenant.

2. All current and future subscriptions may only use EU regions. Where do you assign the policy?

A. Management group assignments are inherited by every subscription underneath, including ones added later.

3. How many levels deep can a management group tree go?

D. The limit is six levels. Microsoft recommends keeping it to three or four.

4. A new subscription is created. Where does it land by default?

C. By default new subscriptions go under the root. Set a default management group so they inherit your guardrails.

5. Which management group gives developers a place to try services that aren't allowed in production yet?

A. A sandbox MG isolates experiments from dev, test and production, with looser service rules but tight budgets.

6. One workload needs extra PCI policies. You want as few management groups as possible. What do you do?

C. A subscription is also a policy boundary, so it isolates the workload without growing the management group tree.

7. Which is not a reason to create a new subscription?

D. Grouping by lifecycle is what resource groups are for. Subscriptions separate billing, admins, scale and compliance.

8. Two departments move to separate subscriptions. Their VMs must keep talking privately. What do you need?

D. A virtual network belongs to one subscription. Connect VNets across subscriptions with peering or VPN.

9. Where should ExpressRoute and Virtual WAN resources live in a well-designed estate?

B. A shared connectivity subscription bills network resources together and isolates them from workloads.

10. The region of a resource group has an outage. Its VMs run in another region. What's true?

C. The resource group's metadata lives in its region. Without it, management operations fail; the resources keep working.

11. App1's web tier is redeployed weekly; its database lives for years. How do you place them?

B. Resources that are deployed and deleted together share a resource group. A different lifecycle means a different group.

12. Which statement about resource groups is true?

B. Resources can live in any region. Resource groups can't be nested or renamed, and each resource is in exactly one.

13. Resources must carry their resource group's costcenter tag, including existing resources. What do you use?

C. Tags don't inherit. A Modify policy fixes new and updated resources; a remediation task fixes existing ones.

14. Which tag type is owner = jsmith?

C. Partnership tags name the people involved. Accounting tags (like department or cost centre) say who pays.

15. Finance wants to see the business value of IT assets, not only their operational cost. Which tagging approach fits?

D. Business-aligned tags (ownership, cost responsibility, criticality) shift the focus to business value.

16. A Contributor creates a storage account with public access. A policy denies public access. What happens?

C. RBAC decides who can act; Policy evaluates the resulting state and denies it regardless of the user's role.

17. Which event does not trigger an Azure Policy evaluation?

A. Evaluations run on resource changes, new or updated assignments, and the 24-hour cycle. Sign-ins aren't involved.

18. A user is Contributor on a subscription and Reader on one resource group in it. What can they do in that resource group?

A. RBAC is additive: effective permissions are the sum of all assignments in scope.

19. What's the default when no rule applies: Azure Policy versus Azure RBAC?

D. Policy rules are allow-by-default. RBAC denies everything until a role allows it.

20. A company with an existing Azure estate wants landing zones without disrupting running workloads. What do you recommend?

D. A new management group structure next to the existing one, in the same tenant, doesn't affect current workloads.

21. Which three subscriptions make up the platform landing zone?

A. The platform landing zone hosts shared services run centrally. Corp and Online are application landing zone groups.

Part B

Design exercise

On paper · about 25 minutes

Larkspur Health runs three hospitals in the Netherlands and one clinic in Belgium.

  1. Task

    Design the management group hierarchy

    Draw the tree from the tenant root down to (not including) subscriptions. Write next to each management group why it exists.

    Done when
    • At most 4 levels below the root.
    • Every management group has a governance reason.
    • There's an isolated place for experiments.
    Hint

    Start from the landing zone reference architecture. Which requirement is different for the Belgian clinic, and does it need a whole branch?

    Model answer
    • Larkspur (top level): Allowed locations = EU; required tags; Defender for Cloud.
    • └ Platform (platform team only) → Identity · Management · Connectivity.
    • └ Landing zones (diagnostics to central workspace) → Corp (HR, research; deny public IPs) · Online (portal; WAF required).
    • └ Sandbox (no hub connectivity, budgets) · Decommissioned.

    The Belgian rule goes on the clinic's subscriptions. Hospitals differ in cost, not in governance, so tags handle them, not management groups.

  2. Task

    Decide subscriptions and resource groups

    List the subscriptions and, for the patient portal, its resource groups. Give the reason (billing, admins, scale or compliance) for each subscription.

    Done when
    • Dev and prod are separated.
    • The GPU-heavy research platform doesn't share quota with others.
    • The network has its own subscription.
    Model answer
    • sub-connectivity, sub-identity, sub-management (admins and billing for shared services).
    • sub-portal-prod/dev under Online; sub-hr-prod/dev and sub-research-prod/dev under Corp (research: scale).
    • Sandbox subscriptions per team.
    • Portal prod: rg-portal-web, rg-portal-data (delete lock), rg-portal-monitor, grouped by lifecycle.
  3. Task

    Attach tags, policies and roles

    Make a table: requirement → control → scope for every requirement.

    Done when
    • Each requirement maps to Policy, RBAC, tags or a structure choice.
    • Roles go to groups at the highest fitting scope.
    • Cost per hospital works for shared resources too.
    Model answer
    RequirementControlScope
    EU onlyAllowed locations (Deny)Larkspur MG
    Belgium CentralNarrower Allowed locationsClinic subscriptions
    Cost per hospital/appTags hospital, app, env; require on RGs + inherit (Modify)Landing zones MG
    No network changes by appsNetwork roles only for grp-platform; app groups Contributor on own subscriptionsConnectivity / app subscriptions
    Safe experimentsSandbox MG, budgets, no hub peeringSandbox MG
    Minimise effortLanding zone accelerator; groups not usersTenant