A company has a management group hierarchy with a root management group that contains all subscriptions. The governance team assigns a built-in Azure Policy initiative 'Allowed Locations' to the root management group with the 'Deny' effect, restricting resource deployment to East US and West US only. After six months, a new regulatory requirement forces the marketing department's subscription (placed under the root) to deploy resources in North Europe for a specific pilot project. The governance team must allow this exception without changing the original policy assignment and without allowing any other subscription to deploy to North Europe. What should the governance team do?

Create a new Azure Policy assignment at the marketing subscription scope with the 'Allowed Locations' initiative set to 'Audit' instead of 'Deny' and include North Europe in the allowed list.

Creating a new assignment at the subscription scope would not override the deny effect from the parent management group. Policy effects are additive, and a deny effect from a higher scope cannot be overridden by an audit effect at a lower scope. This would not grant the permission to deploy in North Europe.

Create an Azure Blueprint that includes the 'Allowed Locations' policy and assign it to the marketing subscription.

An Azure Blueprint can include policy assignments, but it would still apply the deny effect to the marketing subscription since the root management group assignment is still in effect. This does not provide an exception; it only duplicates the restriction.

Assign a custom RBAC role to the marketing subscription that bypasses the policy.

Azure Role-Based Access Control (RBAC) controls who can perform actions on resources, not whether resources can be created. Azure Policy is independent of RBAC; custom roles cannot bypass policy effects. Only exemptions or modifications to the policy itself can grant exceptions.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Create an Azure Policy exemption for the marketing subscription with 'Exempt' category and specify the policy definition and effect to be excluded. — Azure Policy exemptions allow you to exclude a specific scope from a policy assignment while keeping the policy enforced on all other scopes. In this scenario, creating an exemption for the marketing subscription with the 'Exempt' category will permit that subscription to deploy resources to North Europe, while the 'Deny' effect continues to apply to all other subscriptions under the root management group. Modifying the policy assignment or adding another assignment would affect inheritance and potentially allow unintended exceptions. Custom RBAC roles cannot bypass Azure Policy effects.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.