AZ-900 Describe Azure management and governance Practice Question
A company wants to ensure that all new Azure resources in a subscription are automatically tagged with a 'Department' tag. Which Azure service should they use to enforce this requirement?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy with Azure Blueprints, thinking Blueprints can enforce tags, but Blueprints only deploys policies as part of a blueprint definition, not enforce them independently.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can use a built-in or custom policy definition to require a 'Department' tag on all new resources, and Azure Policy will automatically evaluate and enforce this rule during resource creation, preventing non-compliant resources from being provisioned.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Azure Policy is the correct answer because it is the native Azure governance service that evaluates resource creation and update requests in real time against rule definitions. Policies can enforce tagging by using effects such as 'deny' (blocking resource creation if required tags are missing), 'append' (automatically adding a tag with a default value), or 'audit' (logging non-compliant resources). For example, the built-in policy 'Require a tag and its value on resources' ensures every new resource is created with the specified tag, and you can assign it at subscription or management group scope to make the enforcement consistent across all new resources.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints orchestrates the deployment of resource templates and policy assignments, but it does not enforce tagging automatically on new resources in real time—that enforcement is done by Azure Policy through its audit, append, or deny effects. Blueprints is tempting because it is a governance tool for ensuring consistent compliance across subscriptions, and it would be correct if the requirement were to deploy a full environment with pre-configured tagging policies already assigned, rather than enforce tagging at resource creation.
When this WOULD be correct
Azure Blueprints would be correct if the question asked for a service that packages together resource templates, policies, and role assignments to create a compliant environment for deploying new subscriptions or resource groups, such as setting up a standardized governance framework for a new department.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC (Role-Based Access Control) is not the answer because it governs identity and access management, not resource attribute enforcement. RBAC defines who can perform specific actions on resources—such as create, read, update, or delete—by assigning roles to users, groups, or service principals, with permissions expressed in actions and notActions. While RBAC can control whether a user is even able to create a resource, it does not inspect, require, or modify the tags assigned to that resource; a user with full contributor rights could create a resource without any tags, and RBAC has no mechanism to evaluate or enforce tag presence.
When this WOULD be correct
If the question asked which service to use to grant a specific user permission to create resources only in a particular resource group, Azure RBAC would be correct.
- ✗
Azure Resource Lock
Why it's wrong here
Azure Resource Lock is incorrect because it provides a protection mechanism against accidental deletion or modification of already-provisioned resources, not a policy to enforce tagging on new ones. You apply locks at a resource, resource group, or subscription level with the lock types CanNotDelete or ReadOnly, which prevent operations that would remove or change the resource after it exists. A resource lock does not run at creation time to validate whether tags are supplied, nor does it deny creation or append tags automatically—it simply freezes the resource lifecycle after deployment, so it cannot satisfy the requirement to ensure all new resources are tagged.
When this WOULD be correct
A company wants to prevent accidental deletion of a critical production resource group. Azure Resource Lock (specifically a CanNotDelete lock) would be the correct answer to enforce this protection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Azure Policy is the correct answer because it is the native Azure governance service that evaluates resource creation and update requests in real time against rule definitions. Policies can enforce tagging by using effects such as 'deny' (blocking resource creation if required tags are missing), 'append' (automatically adding a tag with a default value), or 'audit' (logging non-compliant resources). For example, the built-in policy 'Require a tag and its value on resources' ensures every new resource is created with the specified tag, and you can assign it at subscription or management group scope to make the enforcement consistent across all new resources.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource templates and policy assignments, but it does not directly enforce tagging on new resources. The requirement to automatically tag new resources is a policy enforcement task, which is the domain of Azure Policy.
★ When this WOULD be the correct answer
Azure Blueprints would be correct if the question asked for a service that packages together resource templates, policies, and role assignments to create a compliant environment for deploying new subscriptions or resource groups, such as setting up a standardized governance framework for a new department.
Why candidates choose this
Candidates may confuse Azure Blueprints with Azure Policy because both are used for governance and compliance, and Blueprints can include policy assignments, leading to the mistaken belief that Blueprints directly enforce tagging.
✗Azure RBACWrong answer — click to see why▾
Why this is wrong here
Azure RBAC manages access control (who can do what), not resource configuration enforcement like automatic tagging. It cannot apply tags to resources automatically.
★ When this WOULD be the correct answer
If the question asked which service to use to grant a specific user permission to create resources only in a particular resource group, Azure RBAC would be correct.
Why candidates choose this
Candidates may confuse RBAC's role-based permissions with policy enforcement, thinking that assigning a 'tagging' role would automatically apply tags.
✗Azure Resource LockWrong answer — click to see why▾
Why this is wrong here
Azure Resource Lock prevents accidental deletion or modification of resources but does not enforce tagging policies. It operates at a resource or resource group level, not on new resource creation across a subscription.
★ When this WOULD be the correct answer
A company wants to prevent accidental deletion of a critical production resource group. Azure Resource Lock (specifically a CanNotDelete lock) would be the correct answer to enforce this protection.
Why candidates choose this
Candidates may confuse 'enforce' with 'lock' or think that a lock can enforce compliance rules, not realizing that locks only prevent changes, not enforce configurations like tags.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.