AZ-900 Describe Azure management and governance Practice Question
Which Azure governance feature enables organizations to enforce that all virtual machines be tagged with a specific 'Owner' tag before deployment?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy (which enforces rules on resource properties) with Azure RBAC (which controls access permissions), leading them to select RBAC when the question is about enforcing a specific tag value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with 'Require tag' in deny mode
Azure Policy with the 'Require tag' effect in deny mode is the correct choice because it can enforce tagging rules at resource creation time by evaluating the request against the policy definition and denying any deployment that does not include the specified 'Owner' tag. This is a native governance feature designed to ensure compliance before resources are provisioned, unlike RBAC or templates which do not enforce tag values.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC with custom permissions
Why it's wrong here
Azure RBAC custom role definitions control access by granting or denying specific actions, such as Microsoft.Resources/subscriptions/resourceGroups/write, to users, groups, or service principals at a particular scope. A custom role can be tailored to allow resource creation, but RBAC cannot inspect or enforce the properties of the created resource, like tag values, because that is not an action within a role's permission list. Only Azure Policy can evaluate the resource attributes during the authorization stage and reject a request that does not carry the mandatory Owner tag, so RBAC alone cannot meet this requirement.
- ✓
Azure Policy with 'Require tag' in deny mode
Why this is correct
Azure Policy with the 'require a tag' initiative and a deny effect actively evaluates every resource creation or update request through the Azure Resource Manager control plane before the resource is provisioned. If the resource does not include the required Owner tag, the policy blocks the operation and returns a policy violation message, ensuring that no non-compliant resource can exist. This enforcement is independent of the client used (portal, CLI, ARM template, Terraform), and it is the correct mechanism because it enforces tagging requirements at the organization's governance layer.
- ✗
Azure Resource Manager template validation
Why it's wrong here
Azure Resource Manager template validation checks that a template is syntactically correct, follows the ARM schema, and references valid resource types, but it does not inspect the resource properties for compliance with corporate standards like mandatory tags. Preflight validation may also verify some deployment prerequisites, yet it never evaluates against Azure Policy definitions; policy evaluation occurs during the actual deployment and can reject the request even if the template is perfectly formatted. Therefore, template validation alone cannot block a resource from being created without an Owner tag, whereas Policy can.
- ✗
Azure DevOps deployment gates
Why it's wrong here
Azure DevOps deployment gates are a pipeline feature that pauses a deployment until manual approval or health-check conditions are satisfied, but they only apply to resources released through that specific pipeline. They do not intercept resource creation performed directly in the Azure portal, via CLI, PowerShell, or other automation tools. Azure Policy, by contrast, evaluates every Azure Resource Manager request at the control plane, so it enforces tag requirements universally across all deployment methods.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.