AZ-900 Practice Question 87: RBAC vs Policy Tool Choice
Microsoft Azure Fundamentals (AZ-900) · Test 9 · question 7 of 10
A governance team has two separate requirements: first, only members of the Network Admins group should be allowed to create or modify virtual networks; second, every storage account created by anyone, regardless of their permissions, must have HTTPS-only traffic enforced. Which combination of tools satisfies both requirements?
Show answer and explanation
Answer:
The two tools split cleanly along *who* versus *what*. Azure RBAC manages who has access to Azure resources, so restricting virtual network creation to one group is an access-control problem; grant that group a role with network-write permissions and no one else. Azure Policy evaluates properties on resources to enforce organizational standards and assess compliance at scale, so a rule that every storage account must enforce HTTPS applies uniformly no matter who created the resource or what permissions they hold; that is a configuration-state problem, and a policy with a Deny effect blocks a noncompliant storage account even from a user who technically has permission to create one.
Option A swaps the tools: Azure Policy has no concept of "which group," and Azure RBAC cannot inspect whether a deployed resource enforces HTTPS. Option C is wrong because Azure RBAC doesn't examine a resource's configuration at all; it only ever asks whether the caller holds a role that grants the requested action. Option D is wrong for the mirror reason; Azure Policy isn't a permissions system, so it cannot decide which specific users or groups are allowed to act.
Reference: Overview of Azure Policy