A developer has the Contributor role on a subscription. Their ARM deployment of a virtual machine with a public IP fails, and the error message says the request is denied by policy. The developer can create other resources successfully. What should you change to allow this deployment while keeping the Contributor role unchanged?

Assign the developer the Owner role on the subscription.

Owner adds broad permissions, but it does not override an Azure Policy deny assignment.

Remove any lock from the virtual machine's resource group.

Locks affect resource operations, but the error explicitly says the request is denied by policy.

Move the virtual machine to another management group.

Changing management group scope only helps if the new scope has a different policy assignment.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Modify or exempt the Azure Policy assignment that blocks public IP addresses. — Azure RBAC and Azure Policy solve different problems. Contributor already grants the user enough permission to deploy a VM, so a failure that explicitly mentions policy means the issue is compliance enforcement, not access control. Azure Policy can deny deployment of disallowed resources such as public IP addresses even for users with powerful roles. To permit the deployment while preserving the role assignment, you must change the policy assignment or create an exemption at the relevant scope. Why others are wrong: Owner would still be blocked by the same deny policy. Locks are unrelated when the error specifically cites policy enforcement. Moving the VM or its scope only helps if the target scope has no blocking policy; it does not bypass an existing deny assignment.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.