AZ-500 Question 213
Select 2You are the Azure Security Engineer for a company with numerous Azure subscriptions. Management wants to ensure each resource is consistently tagged with an 'Environment' tag (e.g., 'Production' or 'Development') for cost and security monitoring. They also require a consolidated, up-to-date view of all existing resources across every subscription, so they can quickly identify any untagged or non-compliant assets. Which two actions should you implement to meet these requirements with minimal overhead?
- A
Create an Azure Policy initiative that audits all resources for the ‘Environment’ tag and automatically applies the tag if it is missing.
- B
Enable Azure Resource Graph and use it to run cross-subscription queries to locate untagged resources.
- C
Deploy Microsoft Defender for Cloud and rely on its default security policy to enforce the required tags on newly created resources.
- D
Use Azure Monitor to configure an activity log alert that sends notifications whenever a resource is created without tags.
Show answer and explanation
Correct answers: A, B
Explanation
To implement security controls for asset management, you need both a method to enforce tagging on new or updated resources and a way to discover and report on existing resources. Azure Policy can apply mandatory tags and audit existing resources for compliance, while Azure Resource Graph provides a cross-subscription query capability for continuously updated resource visibility. For more information, see the Microsoft documentation for Azure Resource Graph (https://docs.microsoft.com/azure/governance/resource-graph/) and Azure Policy (https://docs.microsoft.com/azure/governance/policy/).
- A. Correct.
Option 1 is correct. Azure Policy can be used to either audit or enforce (by automatically adding) required tags on newly created resources. This ensures that all assets have consistent tagging even if a user forgets to specify the tag at creation time.
- B. Correct.
Option 2 is correct. Azure Resource Graph is designed for cross-subscription and cross-tenant resource exploration. It provides a consolidated, near real-time view of resources, making it ideal for discovering any untagged assets and generating comprehensive inventory reports.
- C. Incorrect.
Option 3 is incorrect. While Microsoft Defender for Cloud strengthens an organization’s security posture, it is not primarily responsible for enforcing resource tags. Defender for Cloud can provide recommendations, but automated tagging requires Azure Policy or other specific tag-enforcement mechanisms.
- D. Incorrect.
Option 4 is incorrect. Azure Monitor alerts can notify you of certain events, but they do not natively enforce tagging. You would still need a tool such as Azure Policy to automatically apply the missing ‘Environment’ tag.