Home › Azure AZ-104 › cloudcomputing › az104identitygovernance › Which Azure construct lets you enforce a rule th…
Which Azure construct lets you enforce a rule that "only resources tagged with a `cost-center` value may be created in this subscription"?
AA NSG with a tag-matching rule
BA Cosmos DB schema validation rule
CAn Entra Conditional Access policy
DAn Azure Policy initiative with a `require tag` policy + a deny effect
Answer & Solution
Correct answer: D. An Azure Policy initiative with a `require tag` policy + a deny effect
Azure Policy enforces tag presence with the `Require a tag and its value` built-in (or custom) policies with deny effect. NSGs aren't tag-aware in that way; Conditional Access is for sign-in; Cosmos DB doesn't gate other resources.
Related questions
Which approach satisfies a compliance requirement that admin-level activity on a critical Which Entra ID feature lets you require additional verification for a user the moment theiAn organisation has 50 Azure subscriptions and wants to enforce policy and roll up billingAn admin wants to give a contractor read-only access to ONE specific resource group for 30Which Azure feature lets administrators temporarily revoke all changes to a resource — proWhich Entra ID feature lets an organisation invite external users (partners, contractors) Which combination represents the correct Azure resource hierarchy from highest scope to loWhich Azure construct lets administrators enforce "all storage accounts must require HTTPS