AZ-900 Practice Question 19: Azure Policy Allowed Locations
Microsoft Azure Fundamentals (AZ-900) · Test 2 · question 9 of 10
To satisfy a data residency rule, a company must ensure that nobody can create new resources outside its two approved Azure regions. Existing resources must be left in place, and engineers must keep the permissions they already have. What should be assigned at the subscription scope?
Show answer and explanation
Answer:
Azure Policy compares the properties of resources against business rules and applies an effect when they do not match. Allowed locations is a built-in definition with the Deny effect whose stated job is to restrict the available locations for new resources, and it is the documented way to enforce geo-compliance requirements. Because a Deny effect is evaluated when a resource is created or updated, resources that already exist keep running; they are simply reported as non-compliant.
Option A is the wrong control entirely: a lock protects objects from deletion and says nothing about where a resource may be deployed. Option C misuses RBAC; Azure RBAC governs *who* may perform an action, so removing create permission would block all deployments rather than just those in the wrong region, and the stem requires engineers to keep their permissions. Option D constrains where the *user* is signing in from, not where the *resource* is deployed; a compliant engineer in an approved office could still deploy to a forbidden region.
Reference: Overview of Azure Policy