AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Navigate to Azure Policy, then create a policy definition, then assign the policy definition, then test the assignment.

  Why this is correct

  The proper lifecycle for Azure Policy is to first open the Azure Policy service in the portal, because that is where policy definitions are authored and stored. Next you create a policy definition that specifies the required condition and effect (e.g., deny or audit) using JSON rules. Only after the definition exists can you assign it to a management group, subscription, or resource group, thereby applying the effect at that scope. Finally, test the assignment by evaluating a resource (or using the 'Authoring > Assignments' blade's compliance view) to confirm the policy behaves as intended.

• ✗

  Create a policy definition, then assign it, then navigate to Azure Policy, then test the assignment.

  Why it's wrong here

  This ordering is flawed because you cannot create a policy definition without first entering the Azure Policy blade—definitions are managed under the Policy service, not in some standalone location. Even if you used PowerShell or CLI (New-AzPolicyDefinition) the definition is still registered with the Microsoft.PolicyInsights resource provider, which conceptually requires navigation/configuring that service. Additionally, you should create the definition before assigning it to any scope, but the essential error here is omitting the initial navigation step, which is a prerequisite for all subsequent policy operations.

• ✗

  Assign the policy definition, then create it, then test, then navigate to Azure Policy.

  Why it's wrong here

  This sequence is invalid because a policy assignment binds an existing definition ID to a scope; you cannot assign a definition that has not yet been created, as the assignment would have no policy to reference. Moreover, testing an assignment without first creating the definition is meaningless because there is no effect being evaluated. Placing 'navigate to Azure Policy' at the end is also wrong because the Azure Policy interface is required to access any of these operations, but the primary defect is the attempt to assign before creation, which violates the dependency chain.

• ✗

  Navigate to Azure Policy, then assign the policy definition, then create a policy definition, then test the assignment.

  Why it's wrong here

  Here the user correctly starts in Azure Policy, but then attempts to assign the policy definition before creating it. An assignment action needs the definition's resource ID, and that ID is only generated when the definition is created, so the assignment will fail or be impossible to configure. The correct relative order between create and assign is strictly create-then-assign, regardless of whether you are in the portal or using automation; this sequence reverses that dependency while keeping the navigation step correct, so the only failing part is the premature assignment.

Go deeper

Related to this question