AZ-104 Question 43
Single answerYour organization wants to ensure that all resources in a resource group named 'FinanceRG' include a mandatory 'CostCenter' tag. You have discovered that some developers create new resources without the required tag. What is the most efficient way to enforce this tagging requirement automatically for all new resources in FinanceRG?
- A
Apply a read-only lock to FinanceRG to prevent unauthorized changes to tags
- B
Configure and assign an Azure Policy at the FinanceRG scope that requires the 'CostCenter' tag
- C
Enable resource auto-tagging in Azure Resource Manager templates used during deployment
- D
Use the Azure portal to manually add the 'CostCenter' tag each time a resource is created
Show answer and explanation
Correct answer: B
Explanation
Enforcing tag compliance is best achieved via an Azure Policy scoped to the resource group. By setting a tagging policy requiring the 'CostCenter' tag, all new resources placed in that resource group are enforced to have the tag. Other approaches do not guarantee consistent, automated enforcement.
- A. Incorrect.
A read-only lock prevents all write and delete operations, which is not practical for normal resource management.
- B. Correct.
Assigning an Azure Policy at the resource group scope to require a specific tag is the recommended and automated method to enforce tagging.
- C. Incorrect.
Auto-tagging in ARM templates helps if the resources are deployed via templates, but it wouldn't ensure compliance for resources deployed outside those templates.
- D. Incorrect.
Manually adding tags is prone to human error and doesn't enforce compliance automatically.