A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?

A single RBAC role assignment at the management group.

RBAC controls permissions, not resource compliance requirements or policy reporting.

A management lock on each subscription.

Locks prevent certain changes, but they do not express multiple compliance rules or provide policy compliance reporting.

A private endpoint for Azure Resource Manager.

Private endpoints relate to network access for supported services, not policy-based governance controls.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: An Azure Policy initiative assigned at the management group. — An Azure Policy initiative groups multiple related policy definitions under one assignment. That makes it ideal for enterprise governance requirements such as region restrictions, mandatory tags, and allowed SKU controls across a management group. It also provides a single compliance experience, which is much easier to administer than tracking each policy separately across many subscriptions. Why others are wrong: RBAC does not enforce resource configuration standards or show policy compliance. Locks are too narrow and only affect specific management actions such as delete or write operations. A private endpoint is unrelated to governance and is used to privately reach supported Azure services over a network path.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.