An organization must ensure all new resources are deployed only in approved regions. Which service enforces this rule and blocks non-compliant deployments?
A.Azure RBAC
RBAC controls who can perform actions, not where resources may be deployed.
B.Azure Policy
Azure Policy = rule enforcement like allowed-locations. Correct.
C.Azure resource locks
Locks only prevent deletion/modification — they can't restrict regions.
D.Tags
Tags describe resources; they don't block deployments.
Why this answer
Azure Policy creates, assigns, and enforces rules over resources — e.g., 'allowed locations', allowed SKUs, required tags. Non-compliant deployments are denied or flagged. Locks prevent deletion/modification; RBAC controls who can do what; tags are metadata.
Correct answer: B · Last reviewed 2026-02-13
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Management & Governance practice session.
Practice Management & Governance