Question 58 of 1,049
AZ-104 Manage Azure Identities and Governance Practice Question
A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?
⚠ Common exam trap
Candidates often confuse Azure Policy (which enforces resource properties) with Azure RBAC (which controls permissions), as both are governance tools but serve fundamentally different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy, because it can evaluate and enforce required resource properties.
Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC, because it controls whether users can create resources.
Why it's wrong here
Azure RBAC is identity-based access management that grants or denies users the ability to perform specific actions, such as creating a storage account. It cannot evaluate resource attributes like tags, so even a user with Contributor permissions would be allowed to create a storage account without the required costCenter tag. While RBAC is essential for controlling who can act, it lacks the capability to enforce configuration compliance during resource creation, making it the wrong tool for this requirement.
When this WOULD be correct
If the question asked 'Which feature prevents unauthorized users from creating storage accounts?' or 'Which feature grants permissions to create resources?', then Azure RBAC would be correct because it manages access control.
- ✓
Azure Policy, because it can evaluate and enforce required resource properties.
Why this is correct
This is correct because Azure Policy is designed to enforce standards and assess compliance. A policy can require a tag such as costCenter and deny or audit noncompliant resource creation. RBAC could still allow the user to create storage accounts, but Policy adds the configuration rule that controls whether the deployment is compliant.
- ✗
A resource lock, because it can force resources to use tags.
Why it's wrong here
A resource lock is designed to protect existing resources from accidental deletion or modification by applying the CanNotDelete or ReadOnly lock levels. It operates on the resource's lifecycle after creation and cannot enforce deployment-time requirements like the presence of a specific tag. Resource locks do not evaluate or affect the properties of a newly created storage account, nor do they prevent a user from creating a noncompliant resource in the first place.
When this WOULD be correct
A resource lock would be correct if the question asked how to prevent accidental deletion of a critical storage account that already has the required costCenter tag.
- ✗
A service endpoint, because it can filter which resources are allowed in a subscription.
Why it's wrong here
A service endpoint is a networking feature that allows a subnet to connect directly to a service's public IP addresses, ensuring traffic stays on the Microsoft backbone. It restricts network access to a service, not which resources can be created in a subscription, and it cannot enforce compliance rules like requiring tags. Service endpoints operate at the data-plane network layer, not the management-plane creation layer, so they are irrelevant to preventing storage account creation without a costCenter tag.
When this WOULD be correct
An exam question asking how to restrict storage account access to only traffic from a specific virtual network would make service endpoints correct, as they enable private connectivity and network-level filtering.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy, because it can evaluate and enforce required resource properties.Correct answer▾
Why this is correct
This is correct because Azure Policy is designed to enforce standards and assess compliance. A policy can require a tag such as costCenter and deny or audit noncompliant resource creation. RBAC could still allow the user to create storage accounts, but Policy adds the configuration rule that controls whether the deployment is compliant.
✗Azure RBAC, because it controls whether users can create resources.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC controls permissions to create resources but cannot enforce that created resources include specific tags like costCenter; that requires Azure Policy's evaluation and enforcement capabilities.
★ When this WOULD be the correct answer
If the question asked 'Which feature prevents unauthorized users from creating storage accounts?' or 'Which feature grants permissions to create resources?', then Azure RBAC would be correct because it manages access control.
Why candidates choose this
Candidates may confuse access control (RBAC) with resource compliance enforcement (Policy), assuming that denying creation via RBAC is equivalent to enforcing tags.
✗A resource lock, because it can force resources to use tags.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent deletion or modification of resources but cannot enforce tagging requirements or evaluate resource properties during creation.
★ When this WOULD be the correct answer
A resource lock would be correct if the question asked how to prevent accidental deletion of a critical storage account that already has the required costCenter tag.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking locks can also enforce configuration rules like tags.
✗A service endpoint, because it can filter which resources are allowed in a subscription.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints restrict network access to Azure services, not enforce resource properties like tags. They cannot prevent storage account creation based on missing tags.
★ When this WOULD be the correct answer
An exam question asking how to restrict storage account access to only traffic from a specific virtual network would make service endpoints correct, as they enable private connectivity and network-level filtering.
Why candidates choose this
Candidates may confuse 'filtering' resources with network filtering, assuming service endpoints can filter which resources are allowed in a subscription based on tags or other criteria.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.