AZ-104 Manage Azure Identities and Governance Practice Question
You need to ensure that all new resources deployed to a subscription automatically receive a CostCenter tag with a default value if the tag is omitted during deployment. Which Azure governance feature should you use?
⚠ Common exam trap
Candidates often confuse Azure Policy (which enforces and automatically applies tags) with resource locks or RBAC roles, which manage permissions or prevent changes but do not automatically add missing tags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Azure Policy with an append or modify effect
Azure Policy with an append or modify effect can automatically add a CostCenter tag with a default value to resources that are missing it during deployment. The append effect adds the tag and value at creation time, while the modify effect (using a 'addOrReplace' operation) can also update existing resources. This ensures governance compliance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A resource lock
Why it's wrong here
A resource lock, whether ReadOnly or CanNotDelete, is an access-control guard that blocks authorized users from deleting or modifying a resource or resource group. Locks are evaluated against management-plane operations, so they can prevent tag changes after creation, but they never run during provisioning and cannot add default tags. Enforcing a tagging standard requires a write action to metadata, which locks are incapable of performing.
When this WOULD be correct
A resource lock would be correct in a scenario where you need to prevent accidental deletion or modification of a critical resource, such as a production database or a key vault, by applying a CanNotDelete or ReadOnly lock.
- ✓
An Azure Policy with an append or modify effect
Why this is correct
An Azure Policy with an append or modify effect is evaluated during resource provisioning. Append can inject a required tag such as CostCenter into the resource properties when absent, while modify can add or update tag values and can even use a managed identity to remediate existing non-compliant resources. This happens automatically at deployment time, making it the only option that actually writes metadata as part of the creation flow.
- ✗
A management group lock
Why it's wrong here
A management group lock applies the same lock type (ReadOnly or CanNotDelete) to every subscription and resource under that hierarchy, but it is still a lock, not a policy. It stops modifying operations—for example, it could prevent deleting a resource group—yet it has no mechanism to inject tags into new resources. Like any lock, its purpose is to protect against changes, not to enforce consistent metadata on deployment.
When this WOULD be correct
A management group lock would be correct if the question asked: 'You need to prevent all subscriptions under a management group from being deleted.'
- ✗
A custom RBAC role
Why it's wrong here
A custom RBAC role only changes what actions a security principal is allowed to perform by listing actions and notActions in a role definition. It does not execute code, trigger logic, or modify resources during deployment; it simply authorizes or denies management operations. Because RBAC has no side effects on resource properties, it cannot guarantee that new resources will have a required tag.
When this WOULD be correct
A custom RBAC role would be correct if the question asked: 'You need to prevent users from deleting a specific tag from existing resources. Which feature should you use?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An Azure Policy with an append or modify effectCorrect answer▾
Why this is correct
An Azure Policy with an append or modify effect is evaluated during resource provisioning. Append can inject a required tag such as CostCenter into the resource properties when absent, while modify can add or update tag values and can even use a managed identity to remediate existing non-compliant resources. This happens automatically at deployment time, making it the only option that actually writes metadata as part of the creation flow.
✗A resource lockWrong answer — click to see why▾
Why this is wrong here
Resource locks prevent deletion or modification of resources, but they do not enforce tagging or add default tags to new resources.
★ When this WOULD be the correct answer
A resource lock would be correct in a scenario where you need to prevent accidental deletion or modification of a critical resource, such as a production database or a key vault, by applying a CanNotDelete or ReadOnly lock.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking that locks can also enforce configurations like tags, but locks only protect resources from changes, not enforce compliance.
✗A management group lockWrong answer — click to see why▾
Why this is wrong here
Management group locks prevent deletion or modification of resources at the management group scope, but they do not enforce tagging or add default values to new resources.
★ When this WOULD be the correct answer
A management group lock would be correct if the question asked: 'You need to prevent all subscriptions under a management group from being deleted.'
Why candidates choose this
Candidates may confuse management group locks with Azure Policy, thinking locks can enforce compliance, or they may overestimate the scope of locks to include tag enforcement.
✗A custom RBAC roleWrong answer — click to see why▾
Why this is wrong here
Custom RBAC roles control permissions (who can do what) but cannot enforce tag values or automatically add missing tags during resource deployment.
★ When this WOULD be the correct answer
A custom RBAC role would be correct if the question asked: 'You need to prevent users from deleting a specific tag from existing resources. Which feature should you use?'
Why candidates choose this
Candidates may confuse role-based access control with policy enforcement, thinking that restricting permissions can automatically apply tags.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.