AZ-104 Manage Azure Identities and Governance Practice Question
Exhibit
Governance request: - Allow only East US and West US - Require the tag CostCenter on all resources - Allow only Standard_D and Standard_E VM sizes - The team wants one assignment at the management group scope.
Based on the exhibit, which Azure construct should the administrator create to group these related policy rules into one assignment?
⚠ Common exam trap
Many candidates confuse a policy initiative with a policy exemption, as both involve policy grouping, but only an initiative groups rules for assignment, while an exemption removes resources from evaluation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy initiative
An Azure Policy initiative is a collection of policy definitions designed to group related policies into a single assignable unit. This allows the administrator to apply multiple policy rules together for consistent governance across resources, which is exactly what the question describes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy initiative
Why this is correct
An initiative groups multiple policy definitions into one assignment, which is ideal when the organization wants a single governance package at management group scope. This makes deployment and compliance tracking simpler than assigning each policy separately.
- ✗
Resource lock
Why it's wrong here
A resource lock is a protection mechanism that prevents accidental deletion or modification of a resource at the management group, subscription, resource group, or resource scope. It only controls lifecycle operations (delete/update) and has no concept of evaluating configuration compliance or grouping policy rules. Thus, it cannot serve as a container for multiple governance standards such as allowed locations or required tags.
When this WOULD be correct
A resource lock would be correct if the question asked: 'Which Azure construct should an administrator use to prevent accidental deletion of a critical resource group that contains multiple policy assignments?'
- ✗
Azure RBAC custom role
Why it's wrong here
An Azure RBAC custom role defines a set of permissions (actions, notActions, dataActions) that determine who can perform operations on Azure resources, such as read, write, or delete. It is an identity and access management construct, not a compliance or governance rule engine. Custom roles do not evaluate resource configuration, enforce allowed locations, or require tags, so they cannot replace an Azure Policy initiative for unified compliance tracking.
When this WOULD be correct
An Azure RBAC custom role would be correct if the question asked: 'An administrator needs to create a set of permissions that allow a support team to restart VMs and view diagnostic settings, but not delete resources. Which construct should they create?'
- ✗
Policy exemption
Why it's wrong here
A policy exemption is a scope-specific exclusion that tells Azure Policy to ignore the effects of one or more policy definitions for a particular resource, resource group, or subscription. Instead of bundling rules together, it does the opposite—it removes enforcement and marks the scope as having an exemption for compliance evaluation. Therefore, it is not a vehicle for combining multiple policy definitions into a single governance package.
When this WOULD be correct
When a question asks how to exclude a specific resource from a policy assignment that would otherwise apply to it, such as exempting a test resource from a compliance policy.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy initiativeCorrect answer▾
Why this is correct
An initiative groups multiple policy definitions into one assignment, which is ideal when the organization wants a single governance package at management group scope. This makes deployment and compliance tracking simpler than assigning each policy separately.
✗Resource lockWrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of resources, but they do not group policy rules into an assignment. The question asks for grouping related policy rules, which is the purpose of an Azure Policy initiative.
★ When this WOULD be the correct answer
A resource lock would be correct if the question asked: 'Which Azure construct should an administrator use to prevent accidental deletion of a critical resource group that contains multiple policy assignments?'
Why candidates choose this
Candidates may confuse resource locks with policy assignments because both are used for governance and control, but locks operate at a different layer (resource management vs. compliance rules).
✗Azure RBAC custom roleWrong answer — click to see why▾
Why this is wrong here
Azure RBAC custom roles define permissions for access control (who can do what), not grouping policy rules. The question asks for grouping policy rules into one assignment, which is the purpose of an Azure Policy initiative, not a custom role.
★ When this WOULD be the correct answer
An Azure RBAC custom role would be correct if the question asked: 'An administrator needs to create a set of permissions that allow a support team to restart VMs and view diagnostic settings, but not delete resources. Which construct should they create?'
Why candidates choose this
Candidates may confuse the concept of grouping rules (policy initiative) with grouping permissions (custom role), or think that a custom role can encapsulate policy rules because both involve defining rules/conditions.
✗Policy exemptionWrong answer — click to see why▾
Why this is wrong here
A policy exemption is used to exclude a specific resource or scope from an existing policy assignment, not to group multiple policy rules into a single assignment.
★ When this WOULD be the correct answer
When a question asks how to exclude a specific resource from a policy assignment that would otherwise apply to it, such as exempting a test resource from a compliance policy.
Why candidates choose this
Candidates may confuse 'exemption' with 'initiative' because both involve modifying policy behavior, but exemption is for exclusion, not grouping.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.