A deny policy blocks creation of storage accounts with public network access enabled. A legacy application in RG-Legacy must keep one existing storage account publicly reachable for 45 days while the rest of the subscription remains governed by the policy. What should the administrator configure?

A new role assignment that grants Owner on RG-Legacy.

RBAC does not override Azure Policy evaluation, so extra permissions will not bypass the deny rule.

A management lock on the storage account.

A lock prevents certain management operations, but it does not exempt the resource from policy enforcement.

A separate initiative assigned only to RG-Legacy with the deny setting disabled.

This weakens the governance model and replaces the targeted exemption with a separate policy baseline.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A policy exemption at the RG-Legacy scope with an expiration date. — A policy exemption is the proper way to document and temporarily allow an exception to an enforced policy. By applying it at the RG-Legacy scope with an expiration, the administrator limits the exception to the required workload and keeps the rest of the subscription protected. This approach preserves compliance reporting and avoids weakening the policy definition for every other resource. Why others are wrong: Option B cannot bypass policy because RBAC permissions and policy compliance are separate control planes. Option C is a change-control tool, not a policy exception mechanism. Option D creates unnecessary drift by maintaining a separate, weaker policy path instead of a clearly governed temporary exemption.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.