AZ-104 Manage Azure Identities and Governance Practice Question
A web application is made up of several Azure resources that are deployed, updated, and retired together. The team wants one container for applying access control, tags, and deletion protection consistently to the whole application. What should they use?
⚠ Common exam trap
Test-takers frequently confuse tags as a grouping mechanism for access control or deletion protection, but tags are purely metadata and cannot enforce RBAC or resource locks, whereas a resource group provides a true security and lifecycle boundary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A resource group.
A resource group is the correct container because it is a logical grouping of Azure resources that share the same lifecycle, allowing you to apply access control (RBAC), tags, and deletion protection (resource locks) consistently to all resources within the group. This aligns with the requirement to deploy, update, and retire resources together as a single unit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A subscription dedicated to the application.
Why it's wrong here
A dedicated subscription creates a hard billing and security boundary, but it is overkill for grouping the resources of one web application and introduces excessive administrative overhead. Subscriptions have limits such as 980 resource groups and 10,000 resources per resource group, which are rarely reached by a single app, and moving or deleting an entire subscription is heavy-handed compared to operating on a resource group. Additionally, subscriptions are typically used for environment separation or as a cost boundary, not as the smallest practical container for an application's resources.
When this WOULD be correct
If the question asked for a boundary to isolate billing, enforce subscription-level policies (e.g., Azure Policy at subscription scope), or manage separate environments with distinct cost centers, a dedicated subscription would be correct.
- ✓
A resource group.
Why this is correct
A resource group is the standard lifecycle container for related Azure resources that are managed together. It lets administrators apply RBAC, tags, and locks to the application as a unit while keeping the workload separate from other applications. This is the most practical way to organize resources that are deployed and retired together.
- ✗
A management group.
Why it's wrong here
Management groups sit at the top of the Azure hierarchy and are designed to organize subscriptions, not individual resources. They enforce governance across multiple subscriptions through Azure Policy, RBAC, and compliance reporting, but a management group cannot directly contain a VM, database, or web app—those resources must live inside a resource group within a subscription. Using a management group for a single application would be far too coarse and does not provide the lifecycle container needed, so it is not the right answer.
When this WOULD be correct
When the question asks for a container to apply governance policies (like Azure Policy or RBAC) across multiple subscriptions, such as for an entire department or organization.
- ✗
A tag value that names the application.
Why it's wrong here
A tag value such as the application name is only metadata attached to resources for filtering, cost reporting, and classification in Azure. Tags cannot be used as a scope for Azure RBAC assignments, Azure Policy initiatives, or resource locks, nor can they enable bulk lifecycle operations like deleting or moving all tagged resources together. Because tags do not create a management boundary, they cannot group resources into a deployable or retirable unit, so this option is incorrect.
When this WOULD be correct
When the question asks for a method to filter or group resources for cost reporting or organization without changing management boundaries, a tag value would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A resource group.Correct answer▾
Why this is correct
A resource group is the standard lifecycle container for related Azure resources that are managed together. It lets administrators apply RBAC, tags, and locks to the application as a unit while keeping the workload separate from other applications. This is the most practical way to organize resources that are deployed and retired together.
✗A subscription dedicated to the application.Wrong answer — click to see why▾
Why this is wrong here
A subscription is a billing and management boundary, not a container for applying access control, tags, and deletion protection to a group of resources that are deployed together. Resource groups are designed for that purpose.
★ When this WOULD be the correct answer
If the question asked for a boundary to isolate billing, enforce subscription-level policies (e.g., Azure Policy at subscription scope), or manage separate environments with distinct cost centers, a dedicated subscription would be correct.
Why candidates choose this
Candidates may think a subscription provides a logical container for all resources of an application, confusing subscription-level management with resource group-level management.
✗A management group.Wrong answer — click to see why▾
Why this is wrong here
A management group is used to manage multiple subscriptions, not to group resources within a single subscription for access control, tagging, and deletion protection.
★ When this WOULD be the correct answer
When the question asks for a container to apply governance policies (like Azure Policy or RBAC) across multiple subscriptions, such as for an entire department or organization.
Why candidates choose this
Candidates may confuse management groups with resource groups, thinking both can group resources, but management groups operate at a higher scope (subscriptions) and are not designed for resource-level grouping.
✗A tag value that names the application.Wrong answer — click to see why▾
Why this is wrong here
A tag value alone cannot enforce access control, apply deletion protection, or serve as a container for resources; tags are metadata labels, not management boundaries.
★ When this WOULD be the correct answer
When the question asks for a method to filter or group resources for cost reporting or organization without changing management boundaries, a tag value would be correct.
Why candidates choose this
Candidates may think tags can group resources for consistent management, but tags lack the RBAC, policy, and lock capabilities of a resource group.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.