The platform team wants to block deployment of virtual machines that use any size except a small approved list. Operators already have Contributor access and should keep that access for other tasks. Which Azure control should the administrator use to enforce the size restriction?

Create a custom RBAC role that excludes unsupported VM sizes from the Contributor role.

RBAC roles control what actions a user can perform, but they do not evaluate deployment properties such as SKU size. You cannot use RBAC alone to restrict a VM size list.

Apply a CanNotDelete lock to the resource group that contains the virtual machines.

A CanNotDelete lock prevents deletion, not deployment of disallowed sizes. It would not stop an administrator from creating a VM with an unsupported SKU.

Assign Reader permissions to the operators and rely on Azure portal validation.

Reader removes management rights entirely, which is far beyond the requirement. It also does not represent an enforceable policy-based control for approved VM sizes.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign an Azure Policy with an allowed virtual machine size rule and the Deny effect at the subscription scope. — This is a policy enforcement requirement, not an authorization requirement. Azure Policy can evaluate the VM size in the deployment request and deny any size outside the approved list, while RBAC permissions remain unchanged for other tasks. That clean separation is exactly why policy is the right tool here. Why others are wrong: RBAC roles cannot inspect the VM SKU being requested, so a custom role cannot enforce allowed sizes. A lock only protects against deletion or writes at a resource boundary and does not validate deployment attributes. Reader is too restrictive and does not solve the actual compliance problem.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.