A developer has the Contributor role on a resource group. A Bicep deployment that creates a VM with a public IP fails with a policy denial, but the same template succeeds after the public IP resource is removed. Which two statements are true? Select two.

A CanNotDelete lock is the reason the public IP resource cannot be created.

A CanNotDelete lock only prevents deletion of locked resources. It does not stop creating a new VM, NIC, or public IP, and it does not explain a policy denial message. This distractor confuses resource protection with compliance enforcement.

Assigning Owner on the resource group would automatically bypass the policy denial and allow the template to deploy unchanged.

Owner provides full RBAC permissions at the assigned scope, but Azure Policy still evaluates independently. A deny policy remains effective even for highly privileged users unless the policy definition or assignment changes. RBAC elevation does not override policy compliance rules.

Moving the VM to another subnet in the same virtual network would remove the inherited policy effect.

Policy scope is tied to Azure hierarchy, not to whether a VM uses one subnet or another. Changing the subnet may affect networking, but it does not remove a policy inherited from the management group or subscription. The denial would remain until the policy condition is no longer met.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: The Contributor role allows deployments in the resource group, but it cannot override a deny policy inherited from a higher scope. — The key point is that Azure RBAC and Azure Policy solve different problems. Contributor gives deployment permissions, but it cannot override a deny policy. Because the deployment succeeds when the public IP is removed, the failure is caused by policy evaluation, not access control. Policy assignments inherited from a management group can affect child subscriptions and resource groups, so both the scope inheritance and the RBAC-versus-policy distinction are correct. Why others are wrong: CanNotDelete locks only block deletion, not creation. Owner does not bypass Azure Policy, and moving the VM to another subnet does not change inherited policy scope. Those options confuse permissions, resource placement, and compliance enforcement.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.