Based on the exhibit, which Azure Policy construct should the administrator use to deploy and manage these guardrails as one unit across the department?

Create an Azure RBAC role assignment at the management group scope.

RBAC controls access permissions, not compliance rules, so a role assignment cannot enforce allowed locations or tag requirements.

Apply a ReadOnly lock to each subscription.

A lock blocks management operations, but it does not evaluate compliance or enforce policy conditions like tags and locations.

Move all resources into one resource group.

Resource grouping does not enforce guardrails and does not provide a single compliance object for multiple policies.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create an Azure Policy initiative and assign it at the management group scope. — The correct approach is to create and assign an Azure Policy initiative at the management group scope. An initiative lets the administrator bundle several related policies, such as location restrictions, required tags, and public IP prevention, into one manageable compliance package. Assigning it higher in the hierarchy ensures all current and future subscriptions under that scope inherit the guardrails consistently. Why others are wrong: RBAC role assignments govern who can do what, but they do not enforce resource compliance rules. A ReadOnly lock prevents changes but does not implement the specific policy checks described. Reorganizing resources into a single resource group does not substitute for policy-based governance and would not provide centralized enforcement across multiple subscriptions.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.