AZ-305 practice question 4 of 35

Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Design infrastructure solutions

Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases. The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region. You need to recommend a solution to meet the regulatory requirement. Solution: You recommend using an Azure policy to enforce the location of resource groups. Does this meet the goal?

Answer options

Correct Answer:

Explanation

The proposed solution is incorrect because enforcing the location of a resource group does not enforce the location of the resources created within it. A resource can be deployed to a different region than its parent resource group. The resource group's location only specifies where the metadata for that group is stored. To meet the regulatory requirement of restricting App Service instance locations, an Azure Policy must be applied directly to the App Service resource type (Microsoft.Web/sites) to restrict its location property to the list of approved Azure regions. This ensures direct compliance, whereas the proposed solution creates a compliance gap.

Why Incorrect

A (Yes): This is incorrect. A resource's location is independent of its resource group's location. Therefore, a policy restricting the resource group's location does not guarantee that the App Service instances within it will be in an approved region.

References

1. Microsoft Learn

Azure Resource Manager documentation

"What is a resource group?": Under the "Resources" section

it states

"The location of the resource group can be different than the location of the resources. [...] The resource group stores metadata about the resources. When you specify a location for the resource group

you're specifying where that metadata is stored." This confirms that resource and resource group locations are independent.

2. Microsoft Learn

Azure Policy documentation

"Tutorial: Create and manage policies to enforce compliance": In the "Apply a policy" section

it describes the "Allowed locations" policy. The documentation explains

"This policy definition enables you to restrict the locations your organization can specify when deploying resources." This policy should be assigned and scoped to the App Service resource type to meet the requirement directly.

3. Microsoft Learn

Azure Policy built-in definitions

"Allowed locations": The policy definition ("policyRule": { "if": { "not": { "field": "location"

"in": "[parameters('listOfAllowedLocations')]" } }

"then": { "effect": "deny" } }) demonstrates that the policy acts on the location field of a resource

not its resource group. To be effective for this scenario

it must be applied to the Microsoft.Web/sites resource type.

Question 4 of 35

Question breakdown

Tests: Design governance: enforce resource location with Azure Policy
Difficulty: Medium

Key idea: A resource group's location only stores its metadata, and resources inside it can be deployed to any region.

How to reach the answer

The requirement is that the App Service resources themselves be deployed only to specific regions.
The proposed solution restricts resource group locations.
Resources in a resource group can be placed in a different region from the group itself.
Restricting resource groups therefore does not stop App Service deployments to non-approved regions, so the goal is not met.

Each option

AIncorrect. Restricting where resource groups live does not restrict where the resources inside them are deployed.
BCorrect. Only a policy on resource locations, such as the built-in Allowed locations policy, would enforce the requirement.

Common trap: Assuming resources inherit their resource group's region, because the portal defaults new resources to the group's location.

In practice: Data-residency compliance is normally enforced by assigning the built-in 'Allowed locations' policy at the management group or subscription scope. 'Allowed locations for resource groups' is often added alongside it.

Remember: Resource group location is metadata only, so enforce residency with a resource-level Allowed locations policy.

Official documentation: Manage Azure resource groups by using the Azure portal · Azure Policy built-in policy definitions

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free AZ-305 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test