AZ-104 Manage Azure Identities and Governance Practice Question
An operations team wants to label resources by Department and Environment so they can search and report on ownership across many resource groups. Which two statements are correct? Select two.
⚠ Common exam trap
Many candidates confuse Azure tags with access control or compliance enforcement, mistakenly thinking tags can replace Azure Policy or locks, when in fact tags are purely for organization and metadata.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tags are key-value pairs that can be applied to resources and resource groups.
Azure tags are indeed key-value pairs that can be applied to resources and resource groups. This allows the operations team to label resources with metadata like Department and Environment, enabling efficient searching, filtering, and reporting across multiple resource groups without affecting resource functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Tags are key-value pairs that can be applied to resources and resource groups.
Why this is correct
Tags are key-value pairs that can be applied to resources and resource groups. This is the fundamental definition: each tag consists of a name and a value, and you can attach them to any Azure resource or resource group at creation or after. They are stored as plain metadata alongside the resource and are commonly used for cost allocation, environment identification, and organizational grouping, which makes them the appropriate tool for labeling resources by department.
- ✓
Tags help organize and filter resources, but they do not grant access.
Why this is correct
Tags help organize and filter resources, but they do not grant access. Tags are useful for viewing resources in the portal, searching across subscriptions, and generating cost reports based on metadata; however, they have no effect on authentication or authorization. Azure RBAC controls who can view or manage a resource based on role assignments, while tags simply sit alongside the resource as metadata, so you cannot rely on tags to secure or restrict access.
- ✗
A ReadOnly lock is the best way to record department ownership.
Why it's wrong here
A ReadOnly lock is the best way to record department ownership. A ReadOnly lock is an access-control mechanism that prevents any user from modifying or deleting the locked resource, regardless of their RBAC permissions. It is designed to protect critical infrastructure from accidental changes, not to label or classify resources. To record which department owns a resource, you should apply tag metadata, which is visible in reports and filters; a lock would merely block changes without providing any ownership information.
When this WOULD be correct
If the question asked 'Which action prevents accidental deletion of a resource while preserving its data?', then a ReadOnly lock would be correct.
- ✗
Tags automatically encrypt the data in a resource.
Why it's wrong here
Tags automatically encrypt the data in a resource. This is false because tags are metadata only and do not touch the resource's data plane. Encryption is controlled by Azure Storage Service Encryption, Azure Disk Encryption, or SQL TDE, among other mechanisms, and is configured through the resource's settings, not through tag key-value pairs. Adding or changing a tag does not alter the encryption state or otherwise affect the security posture of the protected data.
When this WOULD be correct
If the question asked 'Which feature automatically encrypts data at rest for Azure managed disks?' then 'Tags automatically encrypt the data in a resource' would be incorrect, but if the question were about 'Which Azure feature can be used to apply encryption to a resource?' the correct answer would be Azure Disk Encryption or Storage Service Encryption, not tags.
- ✗
Tags replace Azure Policy when compliance must be enforced.
Why it's wrong here
Tags replace Azure Policy when compliance must be enforced. This is incorrect because tags are only descriptive metadata; they do not evaluate or enforce any rules. Azure Policy is the service that can audit, deny, or auto-remediate resources that do not follow required tagging standards, such as a mandatory department tag, but the policy engine is separate from the tag itself. While tags can be the subject of policy definitions, they cannot enforce anything on their own, so they do not replace policy.
When this WOULD be correct
If the question asked 'Which feature can be used to enforce tagging rules across resources?' then Azure Policy would be correct, as it can require specific tags on new resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Tags are key-value pairs that can be applied to resources and resource groups.Correct answer▾
Why this is correct
Tags are key-value pairs that can be applied to resources and resource groups. This is the fundamental definition: each tag consists of a name and a value, and you can attach them to any Azure resource or resource group at creation or after. They are stored as plain metadata alongside the resource and are commonly used for cost allocation, environment identification, and organizational grouping, which makes them the appropriate tool for labeling resources by department.
✗A ReadOnly lock is the best way to record department ownership.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents modifications to a resource but does not record ownership; tags are used for metadata like department and environment.
★ When this WOULD be the correct answer
If the question asked 'Which action prevents accidental deletion of a resource while preserving its data?', then a ReadOnly lock would be correct.
Why candidates choose this
Candidates may confuse locks with tags because both are resource-level settings, or think that restricting changes implies ownership recording.
✗Tags automatically encrypt the data in a resource.Wrong answer — click to see why▾
Why this is wrong here
Tags do not encrypt data; they are metadata key-value pairs used for organizing resources. Encryption is handled by Azure Storage Service Encryption, Azure Disk Encryption, or other dedicated services.
★ When this WOULD be the correct answer
If the question asked 'Which feature automatically encrypts data at rest for Azure managed disks?' then 'Tags automatically encrypt the data in a resource' would be incorrect, but if the question were about 'Which Azure feature can be used to apply encryption to a resource?' the correct answer would be Azure Disk Encryption or Storage Service Encryption, not tags.
Why candidates choose this
Candidates may confuse tags with security features or assume that applying a tag like 'Encrypted=true' implies actual encryption, misunderstanding that tags are only labels and do not enforce or provide encryption.
✗Tags replace Azure Policy when compliance must be enforced.Wrong answer — click to see why▾
Why this is wrong here
Tags are metadata labels, not enforcement mechanisms; Azure Policy is used for compliance enforcement, not tags.
★ When this WOULD be the correct answer
If the question asked 'Which feature can be used to enforce tagging rules across resources?' then Azure Policy would be correct, as it can require specific tags on new resources.
Why candidates choose this
Candidates may think tags can enforce compliance because they are used for organization and governance, but they lack the enforcement capability of Azure Policy.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.