A web application is made up of several Azure resources that are deployed, updated, and retired together. The team wants one container for applying access control, tags, and deletion protection consistently to the whole application. What should they use?

A subscription dedicated to the application.

A subscription can isolate a workload, but it is usually too large and expensive to use as the primary container for one application.

A management group.

Management groups are intended for organizing subscriptions and applying governance at a higher level, not for grouping the individual resources of one application.

A tag value that names the application.

Tags help classify resources, but they do not create a management boundary or allow lifecycle operations on the whole application as one unit.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A resource group. — A resource group is the correct organizational boundary for an application that is deployed, managed, and removed together. It provides a single place for access control, tagging, and resource locks, and it keeps related resources together for operational simplicity. Unlike tags, it is a real container, and unlike a management group, it is designed for resources rather than subscriptions. Why others are wrong: A dedicated subscription is usually too broad for one application and adds unnecessary management overhead. A management group is for subscription hierarchy and governance, not for bundling application resources. Tags are helpful metadata, but they do not replace a container that supports lifecycle management and collective administration.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.