A company has 18 subscriptions under a management group named Corp. The audit team needs Reader access to all current and future subscriptions in Corp without creating one assignment per subscription. Which two statements are correct? Select two.

Assign Reader separately at each subscription scope.

Separate subscription assignments would work technically, but they do not meet the requirement to avoid one assignment per subscription.

Assign Reader at one resource group in each subscription.

A resource group assignment is too narrow and would not cover the whole subscription. It also creates many more assignments than requested.

Create a lock on each subscription to provide Reader access.

Resource locks protect resources from changes; they do not grant read permissions. They are unrelated to RBAC access delegation.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Assign Reader at the Corp management group scope. — Reader access should be assigned at the Corp management group scope so every subscription beneath it receives the permission through inheritance. Future subscriptions also inherit that assignment as long as they are placed under Corp. This is the scalable governance pattern for broad read-only access across many subscriptions. Why others are wrong: Per-subscription or per-resource-group assignments are valid in some cases, but they do not satisfy the requirement to avoid many separate assignments. Locks do not provide permissions at all. The key idea is to use the management group hierarchy so access can be inherited instead of managed one subscription at a time.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.