A developer already has permission to create resource groups. The company wants to allow deployments only in the East US and West US regions. Which service should enforce this rule?

Azure RBAC, because region selection is part of user permissions.

This is incorrect because RBAC authorizes actions, but it does not enforce location rules on deployed resources.

A network security group, because it can block unsupported regions.

This is incorrect because NSGs control traffic in and out of subnets or NICs, not where resources are deployed geographically.

A read-only lock, because it limits changes to approved regions.

This is incorrect because locks do not control deployment location and would also block normal management operations.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Azure Policy, because it can restrict which regions are allowed for deployments. — Region restrictions are a classic Azure Policy use case. Policy can evaluate a deployment and deny it if the resource is created in an unapproved location. RBAC does not inspect the content of the deployment; it only decides whether the caller can perform the requested action. Since the company wants to enforce allowed regions, Policy is the correct control. Why others are wrong: RBAC is about authorization, not resource compliance rules. Network security groups only filter network traffic and do not affect deployment geography. A lock would prevent modifications, but it cannot restrict a resource to approved Azure regions and would create unnecessary operational friction.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.