AZ-104 Question 40
Single answerYou are tasked with ensuring that all existing and newly created Azure resources within a specific resource group have a set of mandatory tags (department, environment, and costCenter). You want to automate this process so that existing resources are remediated, and new resources are enforced to have these tags at creation. What is the best approach to achieve this requirement?
- A
Manually assign the tags to existing resources using the Azure CLI and rely on the portal to tag each new resource individually.
- B
Create an Azure Policy initiative with the 'Modify' effect to enforce the required tags on resource creation, and run a remediation task to update existing resources.
- C
Enable Resource Locks on the resource group, which will automatically create and apply the required tags to both new and existing resources.
- D
Use Azure Blueprints to automatically add the required tags only during the initial resource group deployment, without affecting already-deployed resources.
Show answer and explanation
Correct answer: B
Explanation
Azure Policy with the Modify effect allows you to enforce tags at resource creation, and running a remediation task applies the same tags to existing resources. This combination ensures that all resources, both present and future, contain the mandatory tags without requiring manual updates.
- A. Incorrect.
Although the Azure CLI can be used to add tags and manual tagging works for new resources, this does not provide an automated, ongoing enforcement solution for all future resources.
- B. Correct.
Using Azure Policy with the Modify effect ensures that tags are enforced for new resources, and a remediation task updates existing resources to meet the tagging requirements.
- C. Incorrect.
Resource Locks prevent resources from being deleted or modified, but they do not automatically add or enforce tags on existing or new resources.
- D. Incorrect.
Azure Blueprints can deploy resources with certain pre-defined settings, but it does not retroactively ensure that existing resources are tagged, and it doesn't automatically add tags to resources created outside the initial deployment process.