AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use Azure Policy to deny creation of nonapproved VM sizes.

  Why this is correct

  Azure Policy enforces admission control at deployment time: a policy definition with a Deny effect (commonly using the "Allowed virtual machine SKUs" built-in or a custom policy) blocks any Azure Resource Manager (ARM) request that tries to create a VM with a size not present in the allowed list. Because policy evaluation happens before resource creation, even attempts from Terraform, Bicep, or the portal will be rejected, making this the precise mechanism to prevent engineers from deploying unapproved VM sizes.

• ✓

  Use Azure RBAC to grant the restart action on the VMs.

  Why this is correct

  Azure RBAC controls which users or principals can perform specific control-plane operations on existing resources. By creating a custom role that includes the action Microsoft.Compute/virtualMachines/restart/action, you can assign it to engineers at the resource group or individual VM scope, allowing them to restart VMs without granting broader create, delete, or modify permissions. This is a straightforward access-management approach that operates independently of any policy, and it is exactly how you delegate operational actions after a compliant VM is deployed.

• ✗

  Use Azure Policy to grant restart permission when the VM is compliant.

  Why it's wrong here

  Azure Policy simply cannot grant restart permissions because it is not an access-control system. Policy definitions evaluate resource properties and can trigger effects like deny, audit, append, or deployIfNotExists, but they have no mechanism to assign role-based actions to users or principals. Even if a VM is compliant with a policy, the engineer's ability to restart it depends entirely on an RBAC role assignment that includes the restart action; the compliant state does not provide any authorization.

  When this WOULD be correct

  In a scenario where you need to automatically grant a role (e.g., Contributor) to a VM only when it is compliant with a policy (e.g., has specific tags), you could use Azure Policy with a DeployIfNotExists effect to assign an RBAC role. This would be correct if the question asked for automating role assignment based on compliance.

• ✗

  Use a resource lock to approve only specific VM sizes.

  Why it's wrong here

  Resource locks are designed to protect a resource from accidental deletion or modification by setting the lock state to Delete or ReadOnly. They do not inspect VM size properties nor act as an approval gate for new deployments because a lock applies to an existing resource, not to the admission of future resources. Placing a resource lock on a VM does nothing to prevent the creation of a different VM with a nonapproved size, and a ReadOnly lock would actually block changes that could remediate a noncompliant VM.

  When this WOULD be correct

  In a scenario where an administrator wants to prevent accidental deletion or modification of a critical VM, a resource lock (e.g., CanNotDelete) would be the correct solution.

• ✗

  Use tags to enforce the approved VM size list and restart action.

  Why it's wrong here

  Tags are key-value metadata used for cost tracking, resource organization, and filtering in Azure; they carry no enforcement logic and cannot prevent deployment of a nonapproved VM size. While you could tag a virtual machine with an approved size, tags are purely informational and do not intercept API calls, so an engineer could still create a VM using any SKU. Similarly, tags never grant RBAC permissions, so a tag cannot authorize the restart action—that capability can only come from a role assignment.

  When this WOULD be correct

  In a scenario where the question asks for a method to categorize VMs by approval status and trigger compliance workflows, tags could be used to mark approved VM sizes, and an automation runbook could restart tagged VMs.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question