A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.

Assign each policy only to one resource group.

A resource group assignment would be too narrow and would not cover all subscriptions in the department. It also fragments governance.

Use Azure RBAC instead of Policy for both requirements.

RBAC controls access permissions, not compliance rules such as location restrictions or tag auditing. These are policy scenarios, not authorization scenarios.

Create a read-only lock on each subscription.

A lock is not a substitute for policy. It does not audit tags or selectively deny disallowed regions; it mainly protects resources from change.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Create an Azure Policy initiative that contains both policy definitions. — A policy initiative is the best way to package the two related governance rules so they can be managed together. Assigning the initiative at the management group scope applies both rules across the department's subscription hierarchy and automatically covers future subscriptions that are added beneath it. This is the most scalable governance design. Why others are wrong: A single resource group is too narrow for department-wide governance across many subscriptions. RBAC cannot enforce tag or location compliance, and locks do not perform policy evaluation. The requirement is to centralize compliance rules, so initiative plus management group scope is the correct combination.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.