Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Enforcing Consistent Azure Tags with Policy
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization wants to track cloud spending across departments and projects by using Azure tags. To prevent human errors and ensure tagging consistency across all cloud deployments, the governance team needs to implement a standardized tagging strategy.
Which practice should the organization adopt to implement and maintain an effective tagging strategy?
Explanations
Rely exclusively on manual tag entry in the Azure portal and delegate naming decisions to individual resource owners
Rely exclusively on manual tag entry in the Azure portal and delegate naming decisions to individual resource owners
What manual tag entry is
Manual tag entry involves individual administrators or developers typing key-value pairs directly into the Azure portal, CLI, or deployment scripts without centralized naming conventions or automated validation rules.
Why it doesn't meet the requirement
- Lack of consistency: Allowing different team members to define custom tag keys leads to fragmented naming schemes (such as
cost-center,CostCenter, andCC), making automated reporting and cost filtering inaccurate. - High risk of omissions: Manual workflows frequently result in forgotten tags on newly provisioned resources, leaving gaps in governance data.
- No continuous compliance: Without automated audits or enforcement tools, there is no mechanism to detect or correct untagged resources after deployment.
Key characteristics and limitations
- High administrative overhead: Requires repetitive manual data entry for every provisioned asset.
- Susceptible to typos: Case-sensitive tag matching causes minor typographical errors to split billing categories in reporting tools.
- Zero automated governance: Does not provide auditing or self-remediation capabilities across enterprise environments.
This answer would be correct if
The organization were running a small, single-user personal sandbox environment where formal compliance, multi-department cost tracking, and automated governance are unnecessary.
Additional context
Effective cloud governance requires centralized taxonomy definitions paired with automated guardrails rather than unguided, ad-hoc manual tagging.
Define standardized tag naming conventions and use Azure Policy to automatically audit and enforce required tags across resources
Define standardized tag naming conventions and use Azure Policy to automatically audit and enforce required tags across resources
What standardized tagging and Azure Policy enforcement is
A tagging strategy establishes a comprehensive taxonomy of metadata (key-value pairs) attached to Azure resources to support cost accounting, resource management, and operational governance. Combining a formal naming taxonomy with Azure Policy allows organizations to automate governance rules, ensuring resources conform to required tagging schemas without relying solely on manual processes.
How it meets the requirement
- Consistent naming conventions: Predefining standardized keys (such as
Environment,Department, andCostCenter) and allowed value formats prevents naming collisions, casing discrepancies (likedeptvs.Department), and missing attributes. - Automated enforcement and audits: Azure Policy continuously evaluates deployments to identify untagged resources and can automatically apply or inherit tags from parent resource groups using remediation tasks (
modifyorappendeffects). - Accurate cost tracking: By ensuring consistent tag data across all cloud resources, billing reports in Microsoft Cost Management can accurately group and allocate expenditures by project, team, or environment.
Key advantages and capabilities
- Prevents governance drift: Enforces required metadata at deployment time before non-compliant resources enter production.
- Scalable automation: Applies rules across subscriptions and management groups without requiring manual intervention from administrative teams.
- Enhanced visibility: Provides clear operational ownership, lifecycle management, and workload categorization across the enterprise.
- Accurate chargeback and showback: Enables financial accountability by linking cloud consumption directly to departmental budgets.
Why this is optimal
Manual tagging is inherently prone to typos, omissions, and inconsistency. Automating tag enforcement through Azure Policy guarantees organizational alignment, maintains continuous compliance, and ensures cost allocation reporting is reliable and comprehensive.
Create separate resource groups for every department and avoid applying any metadata tags to individual resources
Create separate resource groups for every department and avoid applying any metadata tags to individual resources
What resource groups without tagging represent
Resource groups are logical containers designed to hold related Azure resources sharing a common deployment lifecycle. While they provide basic organizational boundaries, using them exclusively without resource tags severely limits visibility and operational tracking.
Why it doesn't meet the requirement
- Fails multidimensional cost tracking: Relying only on resource group boundaries prevents filtering costs across multiple orthogonal dimensions, such as tracking project owner, environment stage (dev/test/prod), and cost center simultaneously.
- No inheritance by default: Azure resources do not automatically inherit all organizational categorization from their resource groups without tagging policies.
- Inflexible governance: A resource can only belong to a single resource group, whereas tags allow multiple categorizations to coexist on the same resource.
Key characteristics and limitations
- Lifecycle vs. metadata: Resource groups are intended for lifecycle and security management, not comprehensive metadata taxonomy.
- Inability to group across containers: Cannot group or query disparate resources spread across multiple subscriptions or resource groups for unified reporting.
- Restricted auditability: Missing metadata makes auditing orphaned or unassigned workloads difficult.
This answer would be correct if
The goal were solely to define deployment lifecycle scopes and basic role-based access control (RBAC) boundaries for resources deployed together.
Additional context
Best practices recommend combining well-structured resource groups with standardized tags to achieve both lifecycle isolation and multidimensional cost reporting.
Apply resource locks at the subscription level to restrict administrators from modifying existing tag values
Apply resource locks at the subscription level to restrict administrators from modifying existing tag values
What resource locks are
Azure Resource Locks (ReadOnly and CanNotDelete) are protection mechanisms applied to subscriptions, resource groups, or individual resources to prevent accidental modification or deletion of critical cloud assets.
Why it doesn't meet the requirement
- Prevents necessary updates: Applying a
ReadOnlylock across an entire subscription blocks authorized administrators from updating resource configurations, performing operational maintenance, and adding new required tags. - Does not establish a tagging schema: Resource locks do not define naming conventions, validate tag formats, or ensure that newly created resources possess required metadata.
- No automated auditing: Resource locks provide zero capabilities for auditing missing tags or evaluating compliance against governance standards.
Key characteristics and limitations
- Protective, not governance-oriented: Designed to prevent accidental deletions or unintended infrastructure modifications.
- Overly restrictive at high scopes: A subscription-level lock halts all modifications for all resources under that scope.
- Lacks policy logic: Cannot inspect tag key names or enforce specific value formats.
This answer would be correct if
The primary goal was to prevent critical production infrastructure from being accidentally deleted or modified during maintenance operations.
Additional context
Tagging management should be governed through Azure Policy rather than resource locks, as policies guide and enforce metadata standards without blocking normal administrative operations.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tags for Cost Allocation
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tagging
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tags
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Virtual Machine Scale Sets
Describe the resources required for virtual machines
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Compliance Enforcement
Describe infrastructure as code (IaC)
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Monitor Cost Optimization Design
Recommend a monitoring solution
Last updated Validated