A central audit group must have Reader access for every current and future subscription in the company hierarchy. You want one assignment that will apply broadly as new subscriptions are added. Where should the role be assigned?

At one resource group in each subscription

This would require many separate assignments and would miss resources outside those groups.

At a single resource

A single resource scope is too narrow to cover multiple subscriptions.

At the tenant root only for one application

Tenant root is broader than necessary and the wording about one application is unrelated.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: At the management group that contains the subscriptions — Assigning Reader at the management group is the best solution because permissions inherit to all subscriptions beneath that group, including subscriptions created later. This lets the audit team read resources consistently without needing repeated role assignments. It is the preferred design when the same access policy must cover an entire organizational hierarchy. Why others are wrong: Resource group and resource scopes are too narrow and would not cover all subscriptions. A tenant-root-style assignment is broader than needed and is not the normal operational answer when a management group already represents the company hierarchy.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.