A team can already deploy virtual machines, but they want to prevent users from creating VMs unless the deployment includes an approved tag. They also want to see which existing resources do not meet the rule. What should the administrator use?

A custom RBAC role that removes the create action for virtual machines.

RBAC can block creation, but it cannot evaluate whether a deployment includes the required tag.

A resource lock on the resource group.

A lock does not check whether the correct tag is present and would not provide compliance reporting.

An Entra ID dynamic group for the VM creators.

Group membership helps manage access, but it does not enforce deployment rules or resource tagging.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: An Azure Policy assignment with a deny or audit effect for the tag requirement. — The requirement is governance-focused, not permission-focused. Azure Policy can deny noncompliant deployments so new VMs must include the approved tag, and it can audit existing resources to show which ones are already out of compliance. RBAC cannot inspect resource properties during deployment, so it is not the right control for this problem. Why others are wrong: A custom RBAC role can restrict actions, but it cannot enforce tag presence or evaluate the configuration of the deployed resource. Resource locks are for preventing certain management operations, not for policy-based compliance. Entra ID groups are useful for access management, but they do not enforce deployment standards.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.