Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Resource Group Lifecycle Management
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An IT team is deploying a new web application in Azure that consists of several virtual machines, a virtual network, and an Azure SQL database. The team wants to ensure that all these related assets can be managed together across their shared lifecycle, allowing administrators to deploy, configure access permissions, monitor, and delete them as a single logical unit.
Which Azure architectural component should the team use to organize these resources?
Explanations
Management group
Management group
What a Management Group is
A management group is a governance container in Azure that sits above subscriptions in the management hierarchy. Its primary purpose is to provide centralized governance, policy enforcement, and compliance management across multiple Azure subscriptions simultaneously.
Why it doesn't meet the requirement
- Incorrect Scope: Management groups organize and apply governance to subscriptions, not individual application resources like virtual machines, subnets, or databases.
- Cannot Host Direct Resources: You cannot directly deploy individual infrastructure services (such as virtual machines or databases) inside a management group.
- Not Intended for Lifecycle Management: Management groups do not manage the day-to-day deployment and lifecycle operations of individual application components.
Key characteristics and limitations
- Hierarchically organizes up to thousands of subscriptions.
- Used primarily to apply Azure Policy and Azure RBAC across large enterprise subscription structures.
- Does not function as a runtime deployment container for service instances.
This answer would be correct if
The scenario required applying standardized governance rules, compliance policies, or access controls across dozens of distinct Azure subscriptions throughout an entire enterprise.
Additional context
The Azure management hierarchy flows from Management Groups down to Subscriptions, then Resource Groups, and finally individual Resources.
Azure subscription
Azure subscription
What an Azure Subscription is
An Azure subscription is a logical unit of Azure services that is linked to an Azure account. It serves as the primary boundary for billing, quotas, and high-level administrative management in the Microsoft Cloud.
Why it doesn't meet the requirement
- Too Broad in Scope: Subscriptions typically hold hundreds of different resources and multiple applications across an entire department or project team, rather than a single discrete application.
- Not an Application Container: Resources cannot be deployed directly into a subscription without being assigned to an underlying resource group first.
- Lifecycle Overhead: Deleting a subscription to clean up a single multi-tier application would terminate all other unrelated workloads hosted within that subscription.
Key characteristics and limitations
- Generates separate billing reports and invoices.
- Enforces service quotas and limits per subscription.
- Functions above the resource group level in the Azure resource hierarchy.
This answer would be correct if
The requirement was to establish a distinct billing invoice boundary or enforce service consumption limits between separate business units.
Additional context
Every subscription contains one or more resource groups, which in turn hold the actual running Azure services.
Resource tag
Resource tag
What a Resource Tag is
A resource tag is a metadata element consisting of a user-defined key-value pair that you attach directly to Azure resources, resource groups, or subscriptions. Tags help categorize assets according to criteria such as environment, cost center, department, or project owner.
Why it doesn't meet the requirement
- No Container Functionality: A tag is simply metadata; it is not a container that holds or bounds resources together.
- No Lifecycle Management: Tagging resources does not allow you to deploy, update, or delete them in a single operation.
- No Security Boundary: Tags do not serve as an Azure RBAC scope for granting access permissions.
Key characteristics and limitations
- Allows logical grouping of resources across different resource groups and subscriptions.
- Primarily utilized for billing, cost allocation reporting, and asset tracking.
- Does not manage resource dependencies or lifecycle operations.
This answer would be correct if
The scenario asked for a way to track billing costs or identify resources belonging to the accounting department across multiple environments without changing their containment structure.
Additional context
While tags are frequently applied to resource groups to categorize them, tags themselves cannot replace the architectural role of a resource group.
Resource group
Resource group
What an Azure Resource Group is
An Azure resource group is a fundamental logical container designed to hold related Azure resources for an application or workload. Every Azure resource must exist inside exactly one resource group, serving as the core unit of lifecycle management within Azure Resource Manager (ARM).
How it meets the requirements
- Shared Lifecycle Management: Grouping the web application's virtual machines, network, and database into a single resource group allows administrators to manage them collectively. When the workload needs updating, redeploying, or retiring, actions can be applied to the group as a whole.
- Simplified Administration and Deletion: Deleting the resource group automatically deletes all nested resources, avoiding orphaned or unmonitored infrastructure.
- Access Control Scope: Resource groups serve as a standard management boundary where Azure role-based access control (Azure RBAC) permissions can be assigned and automatically inherited by all member resources.
Key advantages and capabilities
- Unified Deployment: Works seamlessly with ARM templates and Bicep to deploy multi-tier architectures in a consistent, repeatable manner.
- Resource Metadata and Location: Stores metadata describing the resources in a specific geographical region to meet compliance needs.
- Centralized Monitoring and Tagging: Enables organization-wide monitoring, cost analysis, and policy enforcement at the container level.
Why this is optimal
A resource group is specifically designed to manage resources sharing an identical operational lifecycle, making it the most efficient architectural choice.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC and Azure Policy
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Storage
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
New-AzResourceGroup Cmdlet
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Manager Templates
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Allowed Locations Built-In
Describe the purpose of Azure Policy
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated