A department has 12 subscriptions under a management group named Corp. New resources must be deployed only in East US or West US and must include a CostCenter tag. A pilot subscription must be exempt from these rules during testing. Which two actions should you take? Select two.

Assign the policies individually at each resource group.

Per-resource-group assignments are harder to manage and do not automatically cover future subscriptions.

Use the Owner role at the management-group scope.

RBAC roles control access, not compliance enforcement or deployment restrictions.

Use a resource lock instead of Azure Policy.

Locks prevent certain changes, but they do not evaluate tags or allowed locations.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Assign an initiative containing both policy definitions at the Corp management-group scope. — The correct design is to assign the combined policy set as an initiative at the Corp management-group scope and then exempt the pilot subscription. That gives you centralized enforcement for every current and future subscription under Corp while preserving one controlled exception for testing. An initiative simplifies administration because the location and tag rules travel together as one governance package. Why others are wrong: Assigning policies at each resource group is operationally expensive and misses new subscriptions unless you add more assignments later. Owner is an access role, not a compliance mechanism. Locks are useful for protection but cannot enforce tag presence or allowed regions. The scenario explicitly needs centralized governance with one exception, which is what management-group assignment plus exemption provides.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.