Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework

Pembrook Financial migrated 60 workloads to Azure over three years. Its security strategy consists of a one-time hardening project completed during migration, after which the security team moved on. A review against the Cloud Adoption Framework Secure methodology found that posture has decayed, there is no incident response plan for cloud workloads, and no one owns security in the operations phase. The CISO asks the architect to evaluate the existing strategy and name the most important structural gap.

What should you identify as the primary gap?

1. ASecurity was treated as a one-time project during Adopt instead of being integrated into every phase of the lifecycle, including Govern and Manage, with ownership for sustaining posture and incident preparationCAF Secure requires security to be integrated into Strategy, Plan, Ready, Adopt, Govern, and Manage, with explicit responsibility for sustaining security posture and for incident preparation and response; a hardening project that ends at migration leaves the Govern and Manage phases unowned, which explains the decay.
2. BThe company did not apply the Well-Architected Framework reliability pillar to each workloadWorkload reliability is a WAF pillar and may be worth reviewing, but it does not explain decayed security posture or the absence of incident response ownership.
3. CThe company did not subscribe to Microsoft Defender for Cloud Defender plans on every subscriptionMissing Defender plans is a symptom that would be found and fixed by a functioning Govern and Manage practice; naming a tool gap misses the structural ownership problem the review exposed.
4. DThe company did not adopt the Microsoft Cybersecurity Reference Architectures during migrationMCRA would have informed the capability design during migration, but the review found that the problem is what happens after deployment, which is a lifecycle and ownership gap rather than an architecture reference gap.

Meridian Robotics has eight data-science teams that each create Azure AI Foundry hubs and Azure OpenAI resources in their own subscriptions. Reviews found resources with public network access enabled, key-based authentication turned on, and no diagnostic logging. The security architect must guarantee a consistent security baseline for every current and future AI resource across all 20 subscriptions while allowing teams to keep deploying on their own. Minimizing ongoing administrative effort is the deciding factor.

What should you recommend?

1. AAssign Azure Policy initiatives for Azure AI services at the management group that contains the data-science subscriptions, using Deny for public network access and local authentication and DeployIfNotExists for diagnostic settingsAzure Policy at management group scope applies the baseline to every existing and future subscription automatically, Deny effects prevent noncompliant AI resources from being created, and DeployIfNotExists remediates logging without anyone touching each resource.
2. BRequire every team to submit each new AI Foundry hub for a manual security review before it can be usedManual review gates scale poorly across eight teams and 20 subscriptions, slow the teams the business wants to keep autonomous, and do nothing about drift after approval.
3. CDeploy network security groups on every subnet that hosts AI resources to block inbound internet trafficNSGs do not govern the public endpoint of a PaaS resource such as Azure OpenAI, and they address none of the authentication or logging gaps found in the review.
4. DEnable Microsoft Defender for Cloud recommendations and ask each team to remediate them monthlyDefender for Cloud will report the gaps, but relying on each team to remediate monthly is advisory and effortful; it does not guarantee a baseline for resources created tomorrow.

Everly Pharmaceuticals is moving from a single sprawling Azure subscription into an Azure landing zone. It has an Active Directory Domain Services forest to extend into Azure, a requirement for centralized security logging that application teams cannot alter, and a requirement that Microsoft Defender for Cloud plans be enabled on every subscription including those created in the future. The design must minimize the privilege held by any one team.

Which three design decisions should you include? Each correct answer presents part of the solution.

1. APlace the central Log Analytics workspace and Microsoft Sentinel in the Management subscription, and use Azure Policy to route diagnostic logs there from all landing zone subscriptionsThe Management subscription is the landing zone home for centralized logging; policy-driven diagnostic settings deliver logs from every workload subscription into a workspace that application teams cannot modify.
2. BDeploy the domain controllers in the dedicated Identity subscription under the Platform management group with access restricted to the identity teamThe Identity subscription isolates Tier 0 identity infrastructure from workloads and platform networking, so only the identity team holds rights over the domain controllers, which limits the privilege any other team holds.
3. CAssign Azure Policy with DeployIfNotExists at the intermediate root management group to enable the required Microsoft Defender for Cloud plans on every subscriptionPolicy at the intermediate root is inherited by every current and future subscription in the hierarchy, so Defender plans are enabled automatically without anyone remembering to configure new subscriptions.
4. DKeep all workloads in a single subscription under the Landing zones management group so that one policy assignment covers everythingA single subscription recreates the sprawl the company is leaving and removes the RBAC and policy isolation between workloads that landing zones exist to provide; policy inheritance works across many subscriptions without this trade-off.
5. EAssign the platform team the Owner role at the tenant root management group so they can manage all subscriptions without further assignmentsOwner at tenant root gives one team unlimited standing privilege over identity, logging, and every workload, which violates the requirement to minimize privilege; landing zone guidance uses scoped roles at the appropriate management groups instead.

Whitlock Retail is deploying the Azure landing zone conceptual architecture with the standard management group hierarchy. The network team needs to place the hub virtual network, Azure Firewall Premium, and the ExpressRoute gateway so that they are managed by the central platform team, isolated from application workloads, and subject to platform-level Azure Policy assignments.

In which subscription should these resources be placed?

1. AThe Connectivity subscription under the Platform management groupThe landing zone architecture dedicates the Connectivity subscription to shared network resources such as the hub virtual network, firewalls, DNS, and gateways, owned by the platform team and governed by Platform management group policies.
2. BThe Identity subscription under the Platform management groupThe Identity subscription hosts identity infrastructure such as Active Directory Domain Services domain controllers; placing network transit there mixes responsibilities and policy scope.
3. CA Corp landing zone subscription under the Landing zones management groupCorp landing zones host application workloads owned by application teams; shared platform networking does not belong there and would be subject to workload-level rather than platform-level policy.
4. DThe Management subscription under the Platform management groupThe Management subscription is for monitoring, logging, and automation resources such as the central Log Analytics workspace, not for network transit.