AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure RBAC, because region selection is part of user permissions.

  Why it's wrong here

  Azure RBAC grants permissions through role definitions that list management actions, but it has no concept of allowable deployment regions. Even a user with the Contributor role can create resources in any location unless an Azure Policy with a deny effect (such as 'Allowed locations') explicitly rejects the request. RBAC only authorizes an identity to perform an action; it does not evaluate or enforce attributes like the region of a resource during deployment. Thus, RBAC is about access control, not compliance enforcement for geographic restrictions.

  When this WOULD be correct

  Azure RBAC would be correct if the question asked: 'A developer needs to be allowed to create resource groups but not delete them. Which service should enforce this rule?' In that case, RBAC can assign a role with specific permissions like 'Contributor' to allow creation but not deletion.

• ✓

  Azure Policy, because it can restrict which regions are allowed for deployments.

  Why this is correct

  This is correct because Azure Policy can enforce a list of allowed locations at deployment time. The developer may still have RBAC permission to create resources, but the policy can deny deployments outside East US and West US. That makes Policy the proper control for region compliance, while RBAC handles access rights separately.

• ✗

  A network security group, because it can block unsupported regions.

  Why it's wrong here

  A network security group (NSG) is a stateful packet-filtering firewall that governs traffic to and from subnets or network interfaces using rules based on source/destination IP, port, and protocol. NSGs operate at the network layer after a resource has been deployed and are completely unaware of Azure Resource Manager provisioning requests or the physical Azure region in which a resource is placed. They cannot intercept deployment-time decisions or block a resource from being created in an unsupported region. Therefore, NSGs are entirely the wrong tool for enforcing location restrictions.

  When this WOULD be correct

  A question asks: 'You need to block all inbound traffic from the internet to a specific subnet in Azure. Which service should you use?' In that case, an NSG with appropriate inbound rules would be correct.

• ✗

  A read-only lock, because it limits changes to approved regions.

  Why it's wrong here

  Azure resource locks are management-layer safeguards that prevent accidental deletion or modification by denying all change operations within the locked scope. A read-only lock (CanNotDelete) blocks any management action that would alter a resource, but it does not analyze the region of a new deployment request. In fact, applying a read-only lock to a resource group prevents any new resource from being deployed because deployment requires write permissions on the group, which the lock denies. This makes the lock not only ineffective for region compliance but also disruptive to normal operations.

  When this WOULD be correct

  A read-only lock would be correct if the question asked: 'Which mechanism prevents accidental deletion or modification of a critical resource group?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question