AZ-900 Describe Azure management and governance Practice Question
A company needs to ensure that no resources in any subscription can be created without a specific cost center tag. Which Azure feature accomplishes this?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces rules) with Azure Blueprints (which packages resources and policies) or RBAC (which controls permissions), leading them to choose a governance tool that does not actually block non-compliant resource creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with a 'require tag' definition in deny mode
Azure Policy with a 'require tag' definition in deny mode is the correct choice because it enforces a rule that blocks the creation of any resource that does not include the specified cost center tag. Azure Policy evaluates resource creation requests against defined policies and can deny non-compliant requests before the resource is provisioned, ensuring governance at the subscription or management group level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Blueprints with tag templates
Why it's wrong here
Azure Blueprints can package and assign policies, but the Blueprint artifact itself only orchestrates deployments; it has no runtime enforcement engine. Even if a Blueprint contains a template with tag parameters, resources created outside that Blueprint remain untagged and unblocked. The compliance guarantee only materializes when the Blueprint includes an Azure Policy assignment, which is the actual enforcement layer.
- ✗
Azure RBAC with custom roles
Why it's wrong here
Azure RBAC custom roles define permissions such as which actions a user can perform on resources, but they never inspect the content or metadata of the created resource. A custom role might grant 'Microsoft.Compute/virtualMachines/write', but it cannot add conditions based on tag presence. Thus, RBAC solves the problem of authorization, not the problem of resource classification and compliance.
- ✓
Azure Policy with a 'require tag' definition in deny mode
Why this is correct
This built-in Azure Policy definition evaluates every create or update request against the rule and, with Deny mode, rejects any that lack the required tag before the deployment begins. Because it is evaluated by the policy engine at the ARM API level, it applies consistently to all resource types and all users. This is the correct, service-native mechanism for mandatory tag requirements.
- ✗
Azure Resource Groups with tag inheritance
Why it's wrong here
Azure Resource Group tags are simply metadata applied to the container, not to the resources inside it. The portal's displayed inheritance is a virtual representation; unless an Azure Policy effect explicitly copies the tag, no child resource receives it. Therefore, relying on Resource Group tagging alone cannot enforce that every resource carries the required tag.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.