A municipal cloud architect says an ARM template will block any resource that lacks a required cost-center tag. Which statement correctly separates ARM templates from Azure Policy?
Select an answer to reveal the explanation.
Short Explanation
Templates build things; Policy watches the rulebook. An ARM template can create a tagged storage account, but Azure Policy is what keeps checking that every resource still follows the city's tagging rules.
Full Explanation
ARM templates and Azure Policy solve different problems in the municipal cloud. An ARM template describes resources to create or update—storage accounts, networks, App Services—and Azure Resource Manager applies that desired state during deployment. Azure Policy evaluates resources against rules such as required cost-center tags and can audit noncompliance or deny noncompliant create/update operations. Templates build; Policy enforces governance after and during resource lifecycle events.
Saying templates audit compliance after resources exist while Policy only deploys VMs reverses the roles and is therefore wrong. Calling templates and Policy interchangeable names for the same service fails because they are distinct capabilities with different portals, APIs, and outcomes. Claiming Azure Policy replaces ARM for all portal and CLI deployments fails because portal, CLI, and PowerShell still submit changes through ARM; Policy layers rules on top of that control plane rather than replacing it.
Exam caveat: a template might include a tag at create time, but only Azure Policy continuously watches the subscription so later portal edits cannot quietly drop the required municipal cost-center tag.
Operational check: deploy a tagged resource with a template, then attempt to create an untagged resource that violates the assignment and confirm Policy audits or denies as configured—proof that deployment and enforcement remain separate levers.