AZ-900 Describe Azure management and governance Practice Question
A company wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically apply the tag to new resources, and also to existing resources that are missing it. Which Azure service should they use?
⚠ Common exam trap
Many exam-takers confuse Azure Policy with Azure Blueprints, thinking Blueprints can enforce tags, but Blueprints only packages policies—it does not enforce or remediate tags itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct service because it can enforce tagging rules by evaluating resources against a policy definition and automatically applying the 'CostCenter' tag to new resources via the 'deployIfNotExists' effect. It can also remediate existing non-compliant resources by triggering a remediation task that applies the missing tag. This makes Azure Policy the ideal tool for governance and compliance at scale.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Azure Policy is the correct service because it can audit, deny, or append compliance settings across existing and new resources. To enforce a costcenter tag, you define a policy with the `Append` effect (to add the tag if missing) or `DeployIfNotExists` with a remediation task, and assign it to a management group, subscription, or resource group. This is the native governance mechanism for enforcing resource properties like required tags.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints is an orchestration tool for packaging Azure Policy assignments, RBAC roles, and ARM templates into a repeatable artifact for new deployments. While a blueprint can include a policy that adds costcenter tags, the blueprint itself does not evaluate or remediate existing resources after assignment. The enforcement behavior comes solely from the underlying Azure Policy definitions, not from the blueprint artifact.
When this WOULD be correct
A company needs to deploy a standardized environment that includes a set of Azure resources (e.g., VMs, databases) with predefined tags, RBAC roles, and policies. They want to ensure consistency across multiple subscriptions. In this scenario, Azure Blueprints would be the correct answer.
- ✗
Azure Resource Manager
Why it's wrong here
Azure Resource Manager (ARM) is the deployment and management layer that handles how resources are provisioned, authenticated, and organized in resource groups. It does not contain a policy engine for auditing or remediating non‑compliant resources; ARM requests are subject to Azure Policy, but ARM itself does not enforce tagging rules. Policy evaluation happens alongside ARM operations, which is a key distinction.
When this WOULD be correct
A company wants to deploy infrastructure as code using templates and needs a service to manage the lifecycle of resource groups, including consistent naming and location enforcement. Azure Resource Manager would be correct for deploying and managing resources via templates.
- ✗
Azure Cost Management
Why it's wrong here
Azure Cost Management is designed for financial operations, not enforcement. It provides cost analysis, budgets, and recommendations for optimizing spend, and it can group or filter costs by tags (including costcenter), but it has no effect that can add, modify, or require a tag on resources. Tagging enforcement is a compliance action, not a cost-accounting function.
When this WOULD be correct
A company wants to set budgets and receive cost alerts based on specific tags, such as 'CostCenter', to monitor spending by department. They need a service to analyze costs and generate reports. Azure Cost Management would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Azure Policy is the correct service because it can audit, deny, or append compliance settings across existing and new resources. To enforce a costcenter tag, you define a policy with the `Append` effect (to add the tag if missing) or `DeployIfNotExists` with a remediation task, and assign it to a management group, subscription, or resource group. This is the native governance mechanism for enforcing resource properties like required tags.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource templates and policies as a package, but it does not automatically apply tags to existing resources or enforce tag policies on new ones; that is the role of Azure Policy.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment that includes a set of Azure resources (e.g., VMs, databases) with predefined tags, RBAC roles, and policies. They want to ensure consistency across multiple subscriptions. In this scenario, Azure Blueprints would be the correct answer.
Why candidates choose this
Candidates may confuse Blueprints with Policy because both are used for governance and compliance, and Blueprints can include policy assignments, leading them to think Blueprints can directly enforce tagging.
✗Azure Resource ManagerWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager is the deployment and management service for Azure, but it does not enforce tagging policies or automatically apply tags to resources. It lacks the policy evaluation and remediation capabilities needed for this requirement.
★ When this WOULD be the correct answer
A company wants to deploy infrastructure as code using templates and needs a service to manage the lifecycle of resource groups, including consistent naming and location enforcement. Azure Resource Manager would be correct for deploying and managing resources via templates.
Why candidates choose this
Candidates may confuse Azure Resource Manager with policy enforcement because it manages resources and can apply tags during deployment via templates, but it cannot automatically enforce or remediate tags on existing resources.
✗Azure Cost ManagementWrong answer — click to see why▾
Why this is wrong here
Azure Cost Management provides cost analysis, budgeting, and optimization tools, but it cannot automatically apply tags to new or existing resources. Tag enforcement and remediation are capabilities of Azure Policy.
★ When this WOULD be the correct answer
A company wants to set budgets and receive cost alerts based on specific tags, such as 'CostCenter', to monitor spending by department. They need a service to analyze costs and generate reports. Azure Cost Management would be the correct answer.
Why candidates choose this
Candidates may associate 'CostCenter' tags with cost management and mistakenly believe Azure Cost Management can enforce tagging policies, confusing its cost analysis features with policy enforcement.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.