A company wants development and production workloads for the same application to have separate budgets, separate subscription administrators, and different access controls. The central IT team still wants to apply the same security policies to both environments. What is the best design?

Use one subscription and separate the environments with tags only

Tags help organization, but they do not create separate billing or administrator boundaries.

Use one management group and two resource groups, one for dev and one for prod

Resource groups are not sufficient when separate budgets and subscription administrators are required.

Put production in a management group and development in a resource group

This mixes hierarchy levels and does not provide a consistent structure for billing and access control.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create a separate subscription for dev and prod, then place both subscriptions under the same management group — When environments need separate budgets and separate subscription-level administration, the boundary should be the subscription. Placing both subscriptions under the same management group gives central IT a single place to apply policies and governance across dev and prod, while still preserving isolation for billing and delegation. Resource groups alone are too limited for those requirements. Why others are wrong: Tags and resource groups do not create billing boundaries or independent subscription admins. Mixing a management group with a resource group also does not create a coherent governance model. The design must use subscriptions for separation and management groups for shared control.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.