AZ-104 Manage Azure Identities and Governance Practice Question
A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?
⚠ Common exam trap
Candidates often confuse Azure Policy (which enforces resource properties) with Azure RBAC (which controls permissions), as both are governance tools but serve fundamentally different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy, because it can evaluate and enforce required resource properties.
Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC, because it controls whether users can create resources.
Why it's wrong here
Azure RBAC is identity-based access management that grants or denies users the ability to perform specific actions, such as creating a storage account. It cannot evaluate resource attributes like tags, so even a user with Contributor permissions would be allowed to create a storage account without the required costCenter tag. While RBAC is essential for controlling who can act, it lacks the capability to enforce configuration compliance during resource creation, making it the wrong tool for this requirement.
When this WOULD be correct
If the question asked 'Which feature prevents unauthorized users from creating storage accounts?' or 'Which feature grants permissions to create resources?', then Azure RBAC would be correct because it manages access control.
- ✓
Azure Policy, because it can evaluate and enforce required resource properties.
Why this is correct
This is correct because Azure Policy is designed to enforce standards and assess compliance. A policy can require a tag such as costCenter and deny or audit noncompliant resource creation. RBAC could still allow the user to create storage accounts, but Policy adds the configuration rule that controls whether the deployment is compliant.
- ✗
A resource lock, because it can force resources to use tags.
Why it's wrong here
A resource lock is designed to protect existing resources from accidental deletion or modification by applying the CanNotDelete or ReadOnly lock levels. It operates on the resource's lifecycle after creation and cannot enforce deployment-time requirements like the presence of a specific tag. Resource locks do not evaluate or affect the properties of a newly created storage account, nor do they prevent a user from creating a noncompliant resource in the first place.
When this WOULD be correct
A resource lock would be correct if the question asked how to prevent accidental deletion of a critical storage account that already has the required costCenter tag.
- ✗
A service endpoint, because it can filter which resources are allowed in a subscription.
Why it's wrong here
A service endpoint is a networking feature that allows a subnet to connect directly to a service's public IP addresses, ensuring traffic stays on the Microsoft backbone. It restricts network access to a service, not which resources can be created in a subscription, and it cannot enforce compliance rules like requiring tags. Service endpoints operate at the data-plane network layer, not the management-plane creation layer, so they are irrelevant to preventing storage account creation without a costCenter tag.
When this WOULD be correct
An exam question asking how to restrict storage account access to only traffic from a specific virtual network would make service endpoints correct, as they enable private connectivity and network-level filtering.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy, because it can evaluate and enforce required resource properties.Correct answer▾
Why this is correct
This is correct because Azure Policy is designed to enforce standards and assess compliance. A policy can require a tag such as costCenter and deny or audit noncompliant resource creation. RBAC could still allow the user to create storage accounts, but Policy adds the configuration rule that controls whether the deployment is compliant.
✗Azure RBAC, because it controls whether users can create resources.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC controls permissions to create resources but cannot enforce that created resources include specific tags like costCenter; that requires Azure Policy's evaluation and enforcement capabilities.
★ When this WOULD be the correct answer
If the question asked 'Which feature prevents unauthorized users from creating storage accounts?' or 'Which feature grants permissions to create resources?', then Azure RBAC would be correct because it manages access control.
Why candidates choose this
Candidates may confuse access control (RBAC) with resource compliance enforcement (Policy), assuming that denying creation via RBAC is equivalent to enforcing tags.
✗A resource lock, because it can force resources to use tags.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent deletion or modification of resources but cannot enforce tagging requirements or evaluate resource properties during creation.
★ When this WOULD be the correct answer
A resource lock would be correct if the question asked how to prevent accidental deletion of a critical storage account that already has the required costCenter tag.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking locks can also enforce configuration rules like tags.
✗A service endpoint, because it can filter which resources are allowed in a subscription.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints restrict network access to Azure services, not enforce resource properties like tags. They cannot prevent storage account creation based on missing tags.
★ When this WOULD be the correct answer
An exam question asking how to restrict storage account access to only traffic from a specific virtual network would make service endpoints correct, as they enable private connectivity and network-level filtering.
Why candidates choose this
Candidates may confuse 'filtering' resources with network filtering, assuming service endpoints can filter which resources are allowed in a subscription based on tags or other criteria.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.