Your organization assigns an Azure Policy at the Corp-MG management group to require the tag Environment on all newly created resources. A deployment to RG-App in the Prod-Sub subscription fails because the tag is missing. You need to allow this single deployment to proceed without weakening enforcement for the rest of the organization. What should you do?

Remove the policy assignment from Corp-MG.

This removes the control for all child scopes and is too broad.

Change the policy effect from Deny to Audit for all assignments.

This weakens enforcement globally instead of solving the one exception.

Move Prod-Sub out of Corp-MG.

This is an unnecessary structural change for a single deployment exception.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Create a policy exemption at the Prod-Sub or RG-App scope. — A policy exemption is the correct way to allow a scoped exception while preserving the existing policy assignment and enforcement elsewhere. Removing the assignment or changing the effect to Audit would weaken governance more broadly than necessary. Moving the subscription out of the management group is an excessive administrative change for a single exception.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.