Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Using Azure Tags to Track Costs by Department
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization has deployed multiple virtual machines, virtual networks, and storage accounts across a single Azure subscription. The finance and operations teams need a way to categorize these resources by department and environment (such as Department: Finance and Environment: Production) to accurately track spending and filter cost reports.
Which Azure feature should the organization use to add this metadata to their resources?
Explanations
Azure Resource Locks
Azure Resource Locks
What Azure Resource Locks Are
Azure Resource Locks are administrative settings that prevent accidental modification or deletion of critical Azure resources, resource groups, or subscriptions.
Why It Doesn't Meet the Requirement
- No Metadata Functionality: Resource locks do not store custom key-value metadata such as department names or operational environments.
- Protection, Not Organization: Locks enforce runtime protection settings (
CanNotDeleteandReadOnly) rather than organizing assets or filtering cost reports. - No Billing Breakdown: Locks do not emit usage tags into Microsoft Cost Management to assist with departmental financial chargebacks.
Key Characteristics and Limitations
- Available in two main lock types:
ReadOnly(prevents changes and deletions) andCanNotDelete(allows updates but prevents deletion). - Applied at subscription, resource group, or individual resource scopes.
- Overrides user role permissions to safeguard infrastructure from unintended changes.
This Answer Would Be Correct If
The organization wanted to prevent users from accidentally deleting or changing production virtual machines and databases.
Azure Role-Based Access Control (Azure RBAC)
Azure Role-Based Access Control (Azure RBAC)
What Azure RBAC Is
Azure Role-Based Access Control (RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management to Azure resources based on user roles and security principals.
Why It Doesn't Meet the Requirement
- Security vs. Categorization: Azure RBAC controls which actions users, groups, or applications can perform on resources; it does not assign descriptive key-value metadata to assets for reporting.
- No Cost Categorization: Role assignments do not label resources for expenditure filtering in billing reports or Cost Management.
Key Characteristics and Limitations
- Uses role definitions (collections of permissions such as Reader, Contributor, or Owner) paired with security principals and scopes.
- Controls control-plane access rather than describing resource business context.
- While roles like
Tag Contributorgrant permission to modify tags, RBAC itself is not the mechanism used to tag or categorize data.
This Answer Would Be Correct If
The organization needed to restrict permissions so that only members of the finance team could view billing data or modify specific financial systems.
Azure Resource Tags
Azure Resource Tags
What Azure Resource Tags Are
Azure Resource Tags are user-defined metadata elements organized as name-value (key-value) pairs of text. They can be attached directly to supported Azure resources, resource groups, and subscriptions to logically categorize and identify assets according to organizational taxonomy.
How It Meets the Requirements
- Key-Value Pair Structure: Tags allow administrators to define custom pairs such as
Department: FinanceorEnvironment: Productionto capture relevant business context. - Cost Tracking and Organization: When attached to resources, tag metadata is emitted alongside resource usage metrics, allowing teams to filter and group expenditure data in Microsoft Cost Management and billing reports.
- Flexible Application: Tags can be applied across diverse resource types during provisioning or updated later using the Azure portal, Azure PowerShell, Azure CLI, or ARM/Bicep templates.
Key Advantages and Capabilities
- Logical Grouping: Enables tracking and managing resources across different resource groups and subscriptions without reorganizing technical hierarchies.
- Billing and Chargeback: Facilitates internal accounting by breaking down invoices according to cost centers, business units, or project owners.
- Automation and Governance: Allows automated operations or compliance audits based on whether specific tag criteria are satisfied.
- Broad Support: Supported across all primary cost-accruing services in Azure.
Why This Is Optimal
Azure Resource Tags are specifically designed for applying lightweight, custom metadata formatted as key-value pairs to resources for organizational taxonomy and cost reporting.
Azure Management Groups
Azure Management Groups
What Azure Management Groups Are
Azure Management Groups provide a governance framework above subscriptions. They allow organizations to organize multiple subscriptions into a hierarchical structure and manage access, policies, and compliance across them as a single collective unit.
Why It Doesn't Meet the Requirement
- Different Purpose: Management groups operate at the subscription governance layer and do not serve as key-value metadata attached to individual resources for cost categorization.
- No Direct Resource Tagging: Management groups cannot have tags applied directly to them, nor do they provide the granular key-value metadata tagging needed across mixed resources inside a single subscription.
- Scope Hierarchy: They are designed for high-level management across multiple subscriptions rather than classifying individual virtual machines or storage accounts.
Key Characteristics and Limitations
- Sits above subscriptions in the Azure resource hierarchy.
- Primarily used for applying Azure Policy and role assignments across multiple subscriptions simultaneously.
- Does not provide custom key-value pairs on individual resources for billing breakdown.
This Answer Would Be Correct If
The organization needed to apply unified governance policies or role-based access controls across dozens of distinct Azure subscriptions organized in a multi-level hierarchy.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tags for Cost Allocation
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Tagging
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Tag Enforcement
Describe the purpose of tags
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Application Insights APM
Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Azure Monitor Application Insights
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zone-Redundant Storage
Describe redundancy options
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated