Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Resource Groups for Shared Lifecycle Management
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is deploying a three-tier web application in Azure that includes a web app, a database, and virtual networking components. The IT team wants to manage all the components of this application together so they can deploy, update, monitor access permissions, and delete them as a single logical unit because they share the same operational lifecycle.
Which Azure architectural component should the administrator use to group and manage these related resources?
Explanations
A resource group
A resource group
What a Resource Group Is
An Azure resource group is a fundamental logical container designed to hold and organize related resources for an Azure solution. It serves as a central building block in Azure Resource Manager (ARM), allowing administrators to allocate, deploy, and manage related cloud assets in a coordinated way.
How It Meets the Requirements
- Lifecycle Management: A resource group enables all components of a solution (such as web frontends, databases, and virtual networks) that share the same development and operational lifecycle to be deployed, updated, and deleted as a single unit.
- Access Control: It acts as a standard scope for Azure role-based access control (Azure RBAC), allowing teams to assign permissions at the resource group level that automatically propagate down to all contained resources.
- Administrative Simplicity: Deleting the resource group cleanly deletes all child resources at once, preventing orphaned or forgotten assets from generating unintended costs.
Key Advantages and Capabilities
- Unified Deployments: Resources within a resource group can be provisioned together using ARM templates or Bicep files.
- Granular Governance Scope: Policies, locks (such as
CanNotDeleteandReadOnly), and RBAC roles can be applied directly at the resource group boundary. - Metadata Storage: The resource group stores metadata about its resources in a designated Azure region for compliance and operational tracking.
- Flexible Resource Movement: Resources can be moved between resource groups as application architectures evolve.
Why This Is Optimal
A resource group is the precise architectural layer intended for grouping assets that share a lifecycle. It provides centralized administrative control and access management without requiring higher-level boundary structures.
An Azure subscription
An Azure subscription
What an Azure Subscription Is
An Azure subscription is a logical container that links an Azure account to the resources created within it. It acts as both a primary billing boundary and an administrative boundary that enforces service limits, quotas, and access control.
Why It Doesn't Meet the Requirement
- Scope Level: Subscriptions serve as broader billing and quota boundaries rather than application lifecycle management containers.
- Internal Organization: Individual solutions and workloads are organized inside resource groups within a subscription, rather than relying on new subscriptions for each three-tier application.
- De-provisioning Complexity: While a subscription can hold all application components, managing lifecycle tasks and single-unit deletions of specific applications within a shared subscription is handled by resource groups.
Key Characteristics and Limitations
- Billing Separation: Generates separate billing statements, cost tracking, and invoice reporting.
- Quota Enforcement: Dictates default service quotas and resource limits across an environment.
- High-Level Scope: Contains one or more resource groups but is too broad for granular application-level lifecycle management.
This Answer Would Be Correct If
This option would be correct if the organization required a dedicated invoice, distinct payment method, or separate billing breakdown for a specific business unit or major department.
Additional Context
Every Azure resource must belong to exactly one resource group, which in turn resides within an Azure subscription.
A management group
A management group
What a Management Group Is
An Azure management group is a high-level organizational container positioned above subscriptions in the Azure governance hierarchy. Its primary purpose is to provide centralized governance, compliance policies, and access management across multiple Azure subscriptions.
Why It Doesn't Meet the Requirement
- Hierarchy Level: Management groups contain subscriptions rather than individual resources like virtual machines, web apps, or databases.
- Granularity: Management groups are intended for enterprise-wide policy enforcement and organizational compliance, not for managing the application lifecycle of individual solution components.
- Resource Deployment: You cannot directly deploy or instantiate individual workload resources inside a management group.
Key Characteristics and Limitations
- Subscription Aggregation: Organizes multiple subscriptions into a unified governance tree up to six levels deep.
- Broad Governance: Applies Azure Policy assignments and RBAC roles across entire sets of subscriptions.
- No Direct Resource Hosting: Does not hold discrete operational assets like storage accounts or compute instances.
This Answer Would Be Correct If
This option would be the right choice if the organization needed to apply governance policies and role assignments uniformly across multiple Azure subscriptions.
Additional Context
In the Azure resource hierarchy, management groups sit at the top, followed by subscriptions, then resource groups, and finally individual resources.
Resource tags
Resource tags
What Resource Tags Are
Resource tags are metadata elements composed of key-value pairs that can be assigned directly to Azure resources, resource groups, and subscriptions. They are used to categorize assets logically for cost tracking, environment identification, or operational reporting.
Why It Doesn't Meet the Requirement
- Not a Container: Tags are descriptive metadata labels, not architectural containers that hold or encapsulate resources.
- No Lifecycle Encapsulation: Applying matching tags to several resources does not allow an administrator to deploy, update, or delete them together in a single operation.
- No Access Inheritance: Tags do not serve as an RBAC scope; assigning a tag to a resource does not provide a boundary for inheriting security permissions.
Key Characteristics and Limitations
- Metadata Only: Consist of simple name-value text pairs (e.g.,
Environment: ProductionorDepartment: Finance). - Cross-Group Organization: Useful for querying or filtering resources across different resource groups and subscriptions.
- No Built-in Protection: Tags cannot lock resources or enforce access restrictions on their own.
This Answer Would Be Correct If
This option would be correct if the administrator needed to label resources across multiple groups and subscriptions to generate customized cost-allocation reports by department or environment.
Additional Context
Tags complement resource groups by adding flexible taxonomy, but they cannot replace the foundational containment and RBAC scope provided by resource groups.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Subscription Billing and Access Boundary
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Hierarchy
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Management Group Policy and RBAC Inheritance
Describe the hierarchy of resource groups, subscriptions, and management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template What-If Operation
Describe Azure Resource Manager (ARM) and ARM templates
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
Managed Identity for Azure DevOps Service Connections
Implement and manage Azure DevOps service connections and personalaccess tokens
Last updated Validated