easyMultiple ChoiceObjective-mapped
AZ-400 Practice Question: A team wants to enforce that all Azure resource…
A team wants to enforce that all Azure resource groups in a subscription are tagged with 'CostCenter' and 'Environment'. They need a solution that automatically applies these tags to any new resource group and ensures compliance without manual intervention. What should they use?
⚠ Common exam trap
Test-takers frequently confuse Azure Blueprints (which can include policies) with Azure Policy itself, but Blueprints are for deploying entire environments, not for continuous, automatic enforcement on all new resource groups across a subscription.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct choice because it allows you to define and enforce tagging rules at scale. By creating a policy that requires 'CostCenter' and 'Environment' tags on resource groups, and setting the policy effect to 'deny' or 'append' (to automatically add missing tags), any new resource group creation that violates the policy is blocked or automatically remediated, ensuring compliance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Azure Policy is the correct service because it uses built-in effects such as 'deny' to block non-compliant resource group creation or 'append' to automatically add required tags, enforcing tagging rules in real time during deployment and continuously. It provides both proactive enforcement and ongoing compliance assessment across subscriptions.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC controls access to Azure resources by assigning roles (e.g., Contributor, Owner) to users, groups, or service principals, but it does not evaluate or enforce resource configuration like mandatory tags. RBAC is purely an identity and access management layer, not a compliance or tagging mechanism, so it cannot enforce tags on resource groups.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints is an orchestration service that packages and deploys a complete environment—resource groups, ARM templates, role assignments, and policy assignments—as a composable, versioned artifact. However, Blueprints itself does not evaluate or enforce tagging rules during resource group creation; any policy enforcement that appears to come from a blueprint is actually delegated to Azure Policy when the blueprint is assigned. Furthermore, Blueprints only deploys resources when explicitly assigned, and it lacks real-time, continuous enforcement over resource groups created outside its scope. Therefore, using Blueprints alone cannot guarantee that every resource group carries the required tags, making it an incorrect choice for this enforcement requirement.
- ✗
Azure Resource Graph
Why it's wrong here
Azure Resource Graph is a query service that enables you to efficiently explore and discover Azure resources across subscriptions using the same APIs used by the portal, but it performs no enforcement actions. It cannot block resource creation, modify resources, or apply tags; it only returns existing resource data, so it is unsuitable for enforcing tagging requirements.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.