AZ104-Q: apply the right governance control
An organization needs every new resource in all production subscriptions to have a
costcentertag and to be deployed only in approved regions. Individual application teams must still receive Contributor access to their own resource groups. Which design best meets all requirements?
- A) Assign Azure Policy definitions/initiative at the appropriate management-group scope for tags/regions, and assign Contributor through RBAC at each team’s resource-group scope. ✓
- B) Give every team Owner at the management-group scope and ask them to tag resources manually.
- C) Use tags as a substitute for access control.
- D) Apply a CanNotDelete lock to every subscription.
Answer: A. Policy governs permitted configuration at scale; RBAC grants the team’s operational permissions at a limited scope. They solve different requirements and work together.
Why not the others: Owner is excessive, tags do not grant/deny access, and a deletion lock does not enforce region or tag policy.