Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Using Azure Resource Tags for Cost Allocation
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization hosts multiple workloads across shared subscriptions for different business units, including Finance, Marketing, and Engineering.
The accounting team needs to track, categorize, and allocate cloud spending to each specific department to support an internal chargeback model in Cost Management.
Which feature should the organization apply to the resources to track and group these costs?
Explanations
Azure Resource Tags
Azure Resource Tags
What Azure Resource Tags Are
Azure Resource Tags are user-defined key-value metadata pairs applied directly to Azure resources, resource groups, and subscriptions. They provide a flexible mechanism to logically categorize and label cloud assets according to business context, operational ownership, environment, or cost accounting requirements.
How It Meets the Cost Allocation Requirement
By assigning consistent key-value pairs (such as Department: Finance or Project: Alpha) across disparate resources, organizations can readily group, filter, and analyze expenditures in Azure Cost Management and Cost Analysis. This metadata flows into billing records and detailed usage reports, allowing finance teams to calculate spend per unit and implement precise internal chargeback or showback accounting.
Key Advantages and Capabilities
- Granular Cost Tracking: Enables filtering and grouping of usage and cost data across different subscriptions and resource groups in Cost Analysis.
- Chargeback and Showback Enablement: Simplifies attributing cloud spend back to individual business units, cost centers, or project codes.
- Policy-Driven Governance: Can be enforced automatically at deployment time using Azure Policy to prevent untagged resource creation.
- Cross-Resource Categorization: Allows grouping related resources that reside in different resource groups or regions under a single logical reporting category.
Why This Is Optimal
Unlike access control or resource-locking mechanisms, tags are specifically designed to enrich resources with organizational metadata that integrates directly with Azure's cost management and reporting tools.
Azure Monitor Alert Rules
Azure Monitor Alert Rules
What Azure Monitor Alert Rules Are
Azure Monitor Alert Rules monitor metrics, log data, and activity logs across Azure resources and proactively notify administrators or trigger automated actions when specific operational or performance thresholds are met.
Why It Doesn't Meet the Requirement
Alert rules evaluate system conditions and send notifications, but they do not assign metadata or categorize infrastructure for billing and financial analysis. They cannot split, filter, or reallocate resource costs by department or project within Cost Management views.
Key Characteristics and Limitations
- Operational Monitoring: Focuses on performance counters (e.g., CPU percentage, memory usage, network traffic) and platform log events.
- Reactive/Proactive Notifications: Triggers emails, webhooks, or automation runbooks when operational criteria are breached.
- Lack of Cost Categorization: Does not tag resources or organize historical billing line items into business groupings.
This Answer Would Be Correct If
The operations team needed to receive an automated notification whenever an application exceeded its expected resource capacity or experienced an outage.
Additional Context
While Cost Management Budgets and Alerts can notify teams when overall spend exceeds predefined financial limits, organizing and attributing that spend to specific departments still relies on resource tags.
Azure Role-Based Access Control (RBAC)
Azure Role-Based Access Control (RBAC)
What Azure Role-Based Access Control (RBAC) Is
Azure Role-Based Access Control (RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management to Azure resources. It allows organizations to grant users, groups, and service principals the specific permissions needed to perform their jobs according to the principle of least privilege.
Why It Doesn't Meet the Requirement
RBAC controls operational actions and access boundaries (such as who can start a virtual machine or view billing data), but it does not tag or label resources for cost allocation. RBAC assignments do not categorize consumption telemetry for grouping spend across departments.
Key Characteristics and Limitations
- Security and Authorization Focus: Enforces security boundaries, role definitions (e.g., Owner, Contributor, Reader), and scope hierarchies.
- No Impact on Usage Records: Assigning an RBAC role to a user or group does not inject department metadata into individual resource telemetry.
- Cost Visibility vs. Allocation: While RBAC roles like Cost Management Reader let users view reports, they do not provide the metadata needed to group and divide shared costs.
This Answer Would Be Correct If
The requirement was to restrict access so that department managers could view only the cost reports and resources belonging to their specific teams.
Additional Context
RBAC permissions determine who can apply tags to resources or access Cost Management data, but tags themselves are required to perform the actual allocation.
Azure Resource Locks
Azure Resource Locks
What Azure Resource Locks Are
Azure Resource Locks are administrative settings that prevent accidental deletion or unintended modification of critical Azure resources, resource groups, or subscriptions. They operate at the management plane to enforce protection levels such as CanNotDelete (Read-Only deletion protection) or ReadOnly (preventing both changes and deletion).
Why It Doesn't Meet the Requirement
Resource locks do not provide metadata categorization, billing segmentation, or spending analytics. They are strictly a governance safeguard for resource availability and state persistence, offering no mechanism to categorize resources by department or filter billing reports for cost allocation.
Key Characteristics and Limitations
- Protective Scope: Designed exclusively to block
DeleteandWriteactions via Azure Resource Manager. - No Billing Metadata: Locks do not append searchable business metadata or department identifiers to usage and billing records.
- Inheritance Behavior: Locks apply downward to all child resources within a resource group or subscription without providing custom categorical breakdown.
This Answer Would Be Correct If
The organization needed to prevent administrators and automated scripts from accidentally modifying or deleting production database servers.
Additional Context
While resource locks are an essential part of management governance, they work independently of financial tracking and cannot be used in cost analysis queries.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Cost Management
Describe cost management capabilities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Cost Analysis
Describe cost management capabilities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Reserved Virtual Machine Instances
Describe cost management capabilities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Cost Management Budgets and Alerts
Describe cost management capabilities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Templates Declarative IaC
Describe infrastructure as code (IaC)
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated