Question

A financial services company is standardizing its Azure environment using the Well-Architected Framework and Cloud Adoption Framework. The security architect must ensure that all workloads deployed by autonomous application teams automatically enforce mandatory controls (encryption at rest, private endpoints, approved regions) without slowing down team velocity, and that non-compliant resources are prevented at deployment time rather than detected after the fact. Which approach best satisfies these requirements?

Accepted Answer

Implement Azure Policy with deny and deployIfNotExists effects assigned at the management group scope, integrated into the landing zone as policy-as-code guardrails

Answer

Enable Microsoft Defender for Cloud regulatory compliance dashboards and review the daily secure score to identify drifting resources

Answer

Require each application team to run a manual security review checklist before every production deployment and document exceptions in a ticketing system

Answer

Grant the central security team Owner rights on all subscriptions so they can remediate misconfigurations after resources are deployed