AI-103 Practice Question 92: Azure Policy Model Governance

The eligibility requirements policy answers "does this model meet my organization's standards for source and maturity?" using attributes rather than identity; its two parameters are exactly onlyAllowDirectFromAzure and denyPreviewModels, and Microsoft's own framing is that it's useful "when you want to enforce broader organizational standards... without maintaining an explicit allow list." Best practice for scope is to assign "at the appropriate scope... management group, subscription, or resource group"; a management group assignment covers every subscription beneath it in one policy assignment, and setting the effect to Deny blocks noncompliant deployments outright rather than only auditing them.

- B is wrong on two counts: the approved models policy requires exactly the explicit allow-list the team wants to avoid maintaining, and assigning it "in each subscription" doesn't scale the way a single management-group assignment does. - C is wrong because an RBAC role assignment controls *who* can create a deployment, not *which* models are eligible; it doesn't encode either of the two stated rules about source or preview status. - D is wrong because Defender for Cloud recommendations are detective controls that surface noncompliant resources after the fact; the requirement is to block the deployment outright, which only a Deny-effect policy assignment does.

Reference: Built-in policies for model deployment