AZ-900 Describe Azure management and governance Practice Question
A company requires that all resources deployed in a production Azure subscription must include a 'Department' tag. Resources without this tag must be automatically prevented from being created. Which Azure service should the company use to enforce this requirement?
⚠ Common exam trap
Many exam-takers confuse Azure Policy with Azure Blueprints, thinking Blueprints can enforce real-time compliance, when in fact Blueprints only deploys policies and other artifacts but relies on Azure Policy for the actual enforcement and denial of non-compliant resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can define a policy that requires the 'Department' tag on all resources, and configure a deny effect to automatically prevent the creation of any resource that does not include this tag. This ensures compliance at the time of resource creation, without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Correct. Azure Policy can enforce rules on resources during creation and throughout their lifecycle. By assigning a policy with a 'deny' effect that requires a specific tag, any attempt to create a resource without that tag will be blocked.
- ✗
Azure Blueprints
Why it's wrong here
Incorrect. Azure Blueprints allows you to define a repeatable set of governance artifacts, including policies and role assignments, but it does not provide real-time enforcement of tags during resource creation. Policies must be assigned independently or as part of a blueprint, but the enforcement is done by Azure Policy, not Blueprints itself.
When this WOULD be correct
A company needs to deploy a standardized environment that includes multiple resource groups, policies, and role assignments consistently across subscriptions. Azure Blueprints would be the correct service to use for creating a repeatable set of Azure resources that include pre-configured policies.
- ✗
Azure Resource Manager
Why it's wrong here
Azure Resource Manager (ARM) is the underlying deployment and management layer that processes API requests to create, update, and delete resources. While it evaluates Azure Policy definitions during resource provisioning, ARM itself does not define or enforce tag requirements; it simply executes the policies that are assigned. Without a policy assignment that mandates a tag, ARM will happily create an untagged resource, so the enforcement responsibility lies with Azure Policy, not ARM.
When this WOULD be correct
A question asks: 'Which Azure service provides a consistent management layer for deploying, managing, and organizing resources, and allows you to deploy templates?' In that context, Azure Resource Manager is the correct answer because it is the service that handles deployment and management of resources via ARM templates.
- ✗
Azure Cost Management
Why it's wrong here
Azure Cost Management is a monitoring and optimization service that analyzes cloud spending and can group costs by tags for reporting and chargeback. However, it operates retrospectively on existing usage data and has no enforcement ability during resource provisioning. It cannot block or deny a deployment that lacks a required tag; it only helps you see the financial impact of resources after they exist.
When this WOULD be correct
A company needs to track and report on spending by department, and wants to ensure that all resources have a 'Department' tag for accurate cost allocation. Azure Cost Management can generate cost reports filtered by tags, but it does not enforce tag existence at creation time.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Correct. Azure Policy can enforce rules on resources during creation and throughout their lifecycle. By assigning a policy with a 'deny' effect that requires a specific tag, any attempt to create a resource without that tag will be blocked.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates as a repeatable set, but it does not enforce tag requirements at creation time; it relies on Azure Policy for enforcement.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment that includes multiple resource groups, policies, and role assignments consistently across subscriptions. Azure Blueprints would be the correct service to use for creating a repeatable set of Azure resources that include pre-configured policies.
Why candidates choose this
Candidates may confuse Blueprints with Policy because both involve governance and compliance, and Blueprints can include policy definitions, leading them to think Blueprints enforces policies directly.
✗Azure Resource ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager (ARM) is the deployment and management service for Azure, but it does not natively enforce tagging requirements. ARM can deploy resources, but it lacks the built-in policy engine to automatically prevent creation of resources missing a tag; that capability is provided by Azure Policy.
★ When this WOULD be the correct answer
A question asks: 'Which Azure service provides a consistent management layer for deploying, managing, and organizing resources, and allows you to deploy templates?' In that context, Azure Resource Manager is the correct answer because it is the service that handles deployment and management of resources via ARM templates.
Why candidates choose this
Candidates may confuse Azure Resource Manager with Azure Policy because both are involved in resource governance. They might think that since ARM controls resource creation, it can enforce tagging rules, not realizing that ARM itself does not evaluate or enforce policies.
✗Azure Cost ManagementWrong answer — click to see why▾
Why this is wrong here
Azure Cost Management is used for monitoring, analyzing, and optimizing cloud costs, not for enforcing tagging requirements or preventing resource creation.
★ When this WOULD be the correct answer
A company needs to track and report on spending by department, and wants to ensure that all resources have a 'Department' tag for accurate cost allocation. Azure Cost Management can generate cost reports filtered by tags, but it does not enforce tag existence at creation time.
Why candidates choose this
Candidates may associate tags with cost management and assume that Azure Cost Management can enforce tagging policies, but it only provides visibility and reporting, not enforcement.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure subscription
An Azure subscription is a logical container in Microsoft Azure that provides billing isolation and access boundaries for your cloud resources and services.
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.