Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Isolating Development and Production with Azure Subscriptions
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is deploying workloads to Azure and needs to separate its Development and Production environments.
The organization has the following requirements:
- Generate distinct billing invoices and cost tracking for each environment
- Enforce independent access control policies so developers cannot modify production workloads
- Establish distinct resource limits and quotas per environment
Which Azure component should the organization use to meet these requirements?
Explanations
Subscriptions
Subscriptions
What an Azure Subscription is
An Azure subscription is a logical container and a fundamental unit of management in Microsoft Azure that links an Azure account with the cloud resources provisioned within it. It serves as both an administrative boundary and a billing boundary, governing how cloud resources are organized, secured, and charged.
How it meets the requirements
- Billing isolation: Azure generates invoices and cost reports at the subscription level by default, allowing organizations to cleanly separate expenses between development and production environments.
- Access management: Subscriptions provide an independent scope for Azure Role-Based Access Control (Azure RBAC), ensuring that permissions assigned to development teams do not automatically inherit into the production environment.
- Quota management: Each subscription has its own set of default resource quotas and limits (such as the maximum number of virtual CPU cores or storage accounts), ensuring development experiments do not consume capacity needed for production workloads.
Key advantages and capabilities
- Environment separation: Enables distinct lifecycles, access rules, and cost centers for dev, test, and prod workloads.
- Granular cost tracking: Simplifies financial chargebacks and budget allocations across departments.
- Flexible governance: Allows independent assignment of governance policies, security baselines, and role assignments.
- Scale and limit isolation: Prevents a single rogue application or testing environment from exhausting organizational cloud quotas.
Why this is optimal
Using separate Azure subscriptions is the recommended cloud architecture best practice for isolating environments with different security profiles, compliance requirements, and funding sources.
Management Groups
Management Groups
What a Management Group is
Management Groups are governance containers positioned above subscriptions in the Azure hierarchy. They allow organizations to manage access, policies, and compliance across multiple subscriptions simultaneously.
Why it doesn't meet the requirement
Management groups are designed to aggregate governance rules and policy assignments across multiple subscriptions, rather than serving as the base unit for resource deployment or billing. Resources such as virtual machines and databases cannot be deployed directly into a management group, and invoices are not generated at the management group level.
Key characteristics and limitations
- Governance scope: Primarily used for applying Azure Policy and RBAC across broad collections of subscriptions.
- Hierarchical structure: Can support up to six levels of depth above subscriptions.
- No direct resource hosting: Cannot directly contain cloud service instances or generate separate individual billing statements.
This answer would be correct if
The scenario required applying standardized governance policies and compliance standards across dozens of individual subscriptions in an enterprise.
Resource Groups
Resource Groups
What a Resource Group is
A Resource Group is a logical container within an Azure subscription that holds related resources for an Azure solution. It is designed to manage the lifecycle, deployment, and monitoring of resources that share the same lifecycle.
Why it doesn't meet the requirement
While resource groups allow you to organize resources and apply Azure RBAC and tags, they do not serve as an independent billing boundary. All costs incurred by resources inside a resource group are billed collectively to the parent subscription, making it impossible to receive entirely separate invoices without custom reporting.
Key characteristics and limitations
- Subscription dependent: A resource group cannot exist independently and must belong to exactly one subscription.
- Shared billing: Costs are rolled up to the containing subscription rather than generating separate billing statements.
- Shared quotas: Resources in all resource groups within a subscription share the same regional quotas and subscription-level limits.
This answer would be correct if
The scenario required grouping resources that share a common deployment lifecycle within the same environment and subscription, such as grouping all components of a single web application together.
Resource Tags
Resource Tags
What Resource Tags are
Resource Tags are metadata key-value pairs applied directly to Azure resources, resource groups, or subscriptions to logically categorize assets for reporting, taxonomy, and operational management.
Why it doesn't meet the requirement
Tags are purely informational metadata and do not create security boundaries, enforce access controls, or segregate resource quotas. While tags can assist in filtering cost data in financial reporting tools, they do not generate separate invoices, restrict developer permissions, or isolate production environments.
Key characteristics and limitations
- Informational only: Tags do not alter resource runtime behavior, performance, or security.
- No access boundaries: Applying a tag cannot prevent an unauthorized user with write access from modifying or deleting a resource.
- No quota enforcement: Tagging cannot establish distinct hardware quotas or service capacity limits.
This answer would be correct if
The scenario required categorizing resources by department name, cost center code, or owner for metadata filtering and chargeback reporting within an existing subscription.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Cost Management Budgets
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Management Group Policy Inheritance
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Subscription Quota Increase Request
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Cost Management Budgets and Cost Alerts
Describe subscriptions
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure IaaS Core Components
Describe infrastructure as a service (IaaS)
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated