Based on the exhibit, an administrator wants to prevent new Azure resources from being deployed in any region except East US and West US across the entire Corp hierarchy. What should the administrator configure?

Assign a built-in RBAC role that denies deployments in unsupported regions.

RBAC controls who can do something, but it does not evaluate whether a deployment targets an approved region. That behavior requires policy.

Apply a CanNotDelete lock to the subscriptions.

A lock prevents deletion or modification of locked resources, but it does not stop new resources from being created in an unapproved region.

Use a resource tag named RegionApproved and require teams to set it manually.

Tags are useful for reporting, but they do not enforce region selection or block deployments. Manual tagging also does not prevent a user from choosing the wrong Azure region.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create and assign an Azure Policy at the Corp management group using the allowed locations rule. — Azure Policy with an allowed locations rule is the right control because the business requirement is compliance enforcement, not access authorization. Assigning it at the Corp management group makes the restriction inherit to all subscriptions and resources beneath it. A deny effect ensures that deployments to any region other than East US or West US are blocked before the resource is created. Why others are wrong: RBAC cannot validate deployment geography. Locks only protect existing resources from deletion or write operations. Tags are a tracking aid, not an enforcement mechanism, so they cannot prevent someone from selecting an unsupported region.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.