A central audit team needs Reader access on every current and future subscription under the company hierarchy. Which scope should you use for the role assignment?

Subscription scope

This would cover only one subscription and would not automatically include future subscriptions.

Resource group scope

This scope is too narrow because it applies only within one resource group.

Resource scope

This applies to only one resource and does not meet the broad audit requirement.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Management group scope — A management group is the best scope when you want a role assignment to apply across multiple subscriptions and automatically flow to new subscriptions placed under that management group. Reader access at this level is a common governance pattern for central teams that need visibility everywhere without creating repeated assignments at each subscription. It also keeps administration simpler over time. Why others are wrong: Subscription scope covers only one subscription, so you would need to repeat the assignment for each future subscription. Resource group and resource scopes are far too narrow for a company-wide audit requirement. Those options do not support the inherited governance model described in the question.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.