A platform team wants to prevent engineers from creating VM sizes that are not approved, but they also need the engineers to be able to restart their own VMs. Which two statements are correct? Select two.

Use Azure Policy to grant restart permission when the VM is compliant.

Policy does not grant operational permissions. It evaluates compliance and can enforce or remediate settings, but it is not an access-control system.

Use a resource lock to approve only specific VM sizes.

Resource locks prevent modification or deletion of resources, but they do not inspect or control which VM sizes can be deployed.

Use tags to enforce the approved VM size list and restart action.

Tags are metadata for organization and reporting. They do not enforce deployment restrictions or grant restart rights.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Use Azure Policy to deny creation of nonapproved VM sizes. — Azure Policy is the correct control for preventing nonapproved VM sizes because it can deny deployments that violate the rule. Azure RBAC is the right control for operational actions like restart because it governs user permissions on Azure resources. The two services solve different problems, so using both provides enforcement plus administration. Why others are wrong: Policy cannot grant runtime permissions, and locks do not validate deployment choices such as VM size. Tags are informational and useful for governance reporting, but they do not enforce behavior. The distinction to remember is that Policy controls compliance, while RBAC controls access and actions.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.