A policy at the management group denies storage accounts that allow public network access. One legacy storage account in RG-Legacy must stay public for 30 days while a migration runs, and the team does not want to change the policy for everyone else. What should the administrator create?

A resource lock on the storage account

A lock controls delete or write behavior, but it does not override Azure Policy evaluation.

A second policy assignment with higher priority

Azure Policy does not use priority order in the same way network rules do, so this is not a valid exception method.

A custom RBAC role for the migration team

RBAC permissions do not change whether a resource is compliant with a policy or exempt from it.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: A policy exemption for that storage account — A policy exemption is the correct governance tool when one resource needs a documented exception to an existing policy assignment. It allows the legacy storage account to remain public temporarily while preserving the deny rule for the rest of the environment. This keeps compliance reporting accurate and avoids weakening security controls globally just to accommodate one migration case. Why others are wrong: A lock affects deletion or modification but does not bypass policy compliance checks. Azure Policy does not rely on priority-based overrides, so a second assignment is not the right exception mechanism. RBAC changes user permissions, not the compliance state of a resource.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.