AZ-900 Describe Azure management and governance Practice Question
An administrator wants to ensure that all Azure resources in a subscription have a 'CostCenter' tag applied. Which Azure service enforces this requirement?
⚠ Common exam trap
Many candidates confuse Azure Policy with Azure Blueprints, thinking Blueprints enforce rules directly, when in fact Blueprints package policies but the enforcement is always performed by Azure Policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects over your resources. In this scenario, you can define a policy that requires the 'CostCenter' tag on all resources, and Azure Policy will automatically evaluate compliance and prevent creation of non-compliant resources or flag existing ones.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Resource Manager locks
Why it's wrong here
Azure Resource Manager locks are management-layer protections that apply to a resource, resource group, or subscription to prevent deletion (CanNotDelete) or prevent all changes (ReadOnly). They are designed to protect against accidental modification or removal, not to validate or enforce resource properties such as tags. Because locks do not evaluate resource metadata and cannot automatically add or deny resources missing tags, they cannot fulfill the requirement to enforce tagging. Therefore, selecting ARM locks for tag enforcement is incorrect.
- ✓
Azure Policy
Why this is correct
Azure Policy is the correct service because it can define rules that evaluate resource properties, including tags, at creation, update, and periodically via compliance scans. Through policy effects such as Deny, Azure Policy will block the deployment of a resource that is missing a required tag, while the Append effect can automatically add the missing tag with a default value. These effects operate during the resource provisioning process, ensuring that tag naming and required tags are consistently applied across subscriptions. This direct property-level enforcement is exactly what the scenario requires.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints is an orchestration service that packages policies, RBAC role assignments, and resource templates into a deployable artifact for creating compliant environments. Although a Blueprint definition can include Azure Policy assignments that enforce required tags, Blueprints itself does not run any enforcement checks. The underlying policy engine in Azure Policy performs the actual Deny or Append operations when resources are created or updated. Therefore, choosing Blueprints as the direct enforcement mechanism is incorrect.
- ✗
Role-Based Access Control
Why it's wrong here
Role-Based Access Control (RBAC) determines which identities can perform actions on Azure resources by evaluating role assignments, such as Contributor or Reader, against the management plane. RBAC is fundamentally an authorization system that controls who can create, modify, or delete resources, but it does not inspect or govern resource metadata like tags. Since tag enforcement requires evaluating and possibly rejecting a resource based on its properties, RBAC lacks the capability to mandate or automatically add tags. Thus, RBAC is not the service that enforces tag compliance.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.