A company has a single Azure subscription that contains resource groups for several business units. The company's compliance team wants to enforce a rule: no virtual network (VNet) can be deployed in any resource group unless the VNet is in a specific allowed region (West Europe). The rule must also block the creation of VNets in disallowed regions, but the team must be able to selectively exempt certain resource groups (e.g., for disaster recovery testing) without altering the underlying rule definition. Which Azure feature should the compliance team implement?

Azure role-based access control (RBAC) by creating a custom role that restricts the 'Microsoft.Network/virtualNetworks/write' action to only the West Europe region, and assign that role to all users.

Incorrect. RBAC controls who can perform actions, but it does not evaluate resource properties like region. Custom roles can restrict actions at a scope, but they cannot inspect the location parameter during the resource creation. Azure Policy is designed for this kind of property-based enforcement.

A resource lock on each resource group that prevents the creation of any resource in disallowed regions.

Incorrect. Resource locks only prevent deletion or modification of a resource group or resource; they cannot prevent creation of new resources based on properties like region. Also, a resource lock applies uniformly to a scope and cannot be selectively applied to specific resource types like VNets.

Azure Blueprints by defining a blueprint that only includes VNets in West Europe and assigning it to all resource groups.

Incorrect. Azure Blueprints are used to deploy and manage standardized environments (resource groups, policies, role assignments, etc.). However, they do not enforce ongoing compliance against future deployments outside the blueprint. To block non-compliant resources, a policy with 'Deny' effect is required.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Azure Policy with the 'Deny' effect assigned to the subscription, and create policy exemptions for the resource groups that need to deploy VNets in other regions. — Azure Policy can enforce organizational standards by evaluating resources for compliance with policy rules. The 'Deny' effect prevents creation of non-compliant resources. Policy exemptions allow specific scopes (like a resource group) to be excluded from the policy assignment while the policy definition remains unchanged. This is more flexible than using a resource lock (which only prevents deletion or modification), a custom role (which controls permissions, not resource properties), or a blueprint (which is used for deploying repeatable environments but does not inherently block non-compliant deployments).

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.