Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Department Chargeback with Key-Value Resource Tags
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise runs workloads for multiple business units—such as Finance, Human Resources, and Marketing—within a single Azure subscription. The accounting team requires a method to categorize and track cloud spending by department so they can generate accurate internal chargeback reports in Microsoft Cost Management without redesigning their subscription structure.
Which Azure feature should the organization use to allocate and filter resource costs by department?
Explanations
Azure Role-Based Access Control (Azure RBAC)
Azure Role-Based Access Control (Azure RBAC)
What Azure RBAC Is
Azure Role-Based Access Control (Azure RBAC) is an authorization system that provides fine-grained access management for Azure resources based on user identities and assigned roles.
Why It Doesn't Meet the Requirement
Azure RBAC controls who has permission to perform operations (such as creating, reading, updating, or deleting resources), but it does not label resources with business metadata or categorize consumption for billing and accounting purposes.
Key Characteristics and Limitations
- Identity and access control: Restricts administrative and user actions based on built-in or custom role definitions.
- Security boundary: Focuses on the principle of least privilege rather than financial telemetry.
- No billing categorization: Does not add searchable metadata to cost reports or invoice exports.
- Operational focus: Determines permissions rather than financial responsibility or cost center allocation.
This Answer Would Be Correct If
The requirement was to grant the accounting team read-only access to view billing details while preventing them from modifying virtual machines or storage accounts.
Additional Context
Although RBAC roles like Cost Management Reader allow users to view financial reports, the reports themselves depend on resource tags to display departmental cost breakdowns.
Resource tags
Resource tags
What Resource Tags Are
Azure resource tags are user-defined metadata elements structured as key-value pairs (such as Department : Marketing or CostCenter : 10450) applied directly to Azure resources, resource groups, or subscriptions.
How It Meets the Cost Allocation Requirement
Resource tags provide the contextual business taxonomy necessary to categorize and aggregate spending. When resources generate usage data, the associated tag keys and values are appended to the billing telemetry. Within Microsoft Cost Management, financial teams can filter and group spending data based on specific tag keys, allowing them to track consumption per business unit without having to create separate subscriptions or move resources.
Key Advantages and Capabilities
- Granular cost tracking: Enables grouping and filtering of usage and billing metrics across diverse resource types and locations.
- Organizational flexibility: Allows custom taxonomy across dimensions like environment, department, owner, or project code.
- Billing report integration: Directly populates into downloadable usage files and invoices for easy accounting reconciliation.
- Tag inheritance support: Works with Cost Management features to pass billing profile or subscription tags down to child usage records.
Why This Is Optimal
Using resource tags is the standard, most cost-effective method for enabling organizational chargeback and budgeting within a shared subscription model, avoiding the administrative overhead of deploying separate management hierarchies solely for cost accounting.
Management groups
Management groups
What Management Groups Are
Management groups are governance containers positioned above subscriptions in the Azure resource hierarchy, designed to manage access, policies, and compliance across multiple subscriptions systematically.
Why It Doesn't Meet the Requirement
Management groups organize and govern multiple subscriptions, but the scenario specifies that all departmental workloads reside within a single subscription. Furthermore, management groups do not support direct resource tagging for internal departmental cost allocation inside an individual subscription.
Key Characteristics and Limitations
- Hierarchical scope: Exists above subscriptions to apply Azure Policy and RBAC across an enterprise estate.
- Subscription-level aggregation: Aggregates governance across subscriptions rather than partitioning single-subscription resources.
- Cannot tag directly: Azure does not support applying resource tags directly to management groups.
- Overhead for single subscriptions: Ineffective for categorizing individual resources that share the same subscription container.
This Answer Would Be Correct If
The company maintained separate subscriptions for every department and needed a unified structure to enforce compliance policies across all of them.
Additional Context
Management groups are essential for large-scale enterprise architecture, but resource tags provide the granular, cross-cutting metadata needed for cost tracking inside shared environments.
Resource locks
Resource locks
What Resource Locks Are
Azure resource locks are administrative settings that prevent accidental modification or deletion of critical Azure resources, resource groups, or subscriptions.
Why It Doesn't Meet the Requirement
Resource locks function exclusively as operational safeguards and do not attach business metadata or categorize financial usage data. They offer two settings—CanNotDelete and ReadOnly—neither of which provides functionality for tracking, grouping, or filtering expenditures in Microsoft Cost Management.
Key Characteristics and Limitations
- Accidental deletion prevention: Blocks unauthorized or unintended deletion operations on locked resources.
- Modification control: Restricts configuration updates when configured with read-only constraints.
- No metadata attachment: Does not provide key-value tagging or custom business grouping capabilities.
- No billing impact: Has zero influence on billing breakdowns, cost categorization, or accounting reports.
This Answer Would Be Correct If
The organization needed to prevent administrators or automated scripts from accidentally deleting production databases or modifying essential virtual networks.
Additional Context
While resource locks are vital for governance and operational stability, cost allocation relies on resource tags to identify business ownership and cost centers.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tags
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Tag Enforcement
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tagging
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Private Endpoint DNS Resolution
Define public and private endpoints
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template What-If Operation
Describe Azure Resource Manager (ARM) and ARM templates
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated