Security wants one assignment that enforces all of these controls across several subscriptions: allowed Azure regions, required tags, and disabling public network access on specific resources. Which Azure feature should you use?

A single Azure Policy definition with one rule for all three controls

One policy definition usually targets one logical control; these requirements are better grouped together.

A management group lock applied to the subscriptions

Locks do not evaluate compliance or enforce multiple configuration standards.

A custom RBAC role assigned at the management group

RBAC grants access, but it does not enforce configuration or compliance settings.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: An Azure Policy initiative that contains multiple related policy definitions — An Azure Policy initiative is the right fit when you want a single assignment to include several policy definitions. That allows security to manage a baseline such as allowed locations, required tags, and network settings from one place, while still tracking compliance per policy. It is more maintainable than assigning each policy separately across multiple subscriptions. Why others are wrong: One policy definition is not the best fit for multiple distinct controls. Locks prevent deletion or changes but do not evaluate compliance. RBAC controls who can act, not what configuration the resources must have.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.