A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.

Assign the policies separately to each existing subscription only.

This misses future subscriptions and creates repetitive administration. It also makes compliance harder to manage across the enterprise.

Use an RBAC Contributor role to enforce region and tag compliance.

RBAC controls authorization, not resource configuration compliance. It cannot force allowed regions or required tags the way Azure Policy can.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create a policy initiative that groups the governance requirements. — The correct solution is to group the allowed-location and required-tag policies into an initiative and assign that initiative at the management group scope. This ensures the governance rules apply to all current and future subscriptions beneath the management group. Policies handle compliance enforcement, while the initiative provides centralized assignment and reporting for multiple related rules. Why others are wrong: Assigning separately to each subscription is operationally expensive and misses future subscriptions. RBAC does not enforce configuration compliance, so it cannot replace Azure Policy. The management group scope is important because it allows the rules to inherit to everything below it.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.