A developer has Contributor on a resource group but a deployment to a prohibited region is rejected. Which explanation best fits the governance model?

Choose the single best answer.

A.An audit policy always blocks deployment.
B.Contributor automatically bypasses every Azure Policy assignment.
C.The cost-center tag is the only permission checked at deployment.
D.Azure RBAC permits management operations, while an applicable deny policy constrains the deployment.

Show the answer and explanation

✓ Correct answer

Azure RBAC permits management operations, while an applicable deny policy constrains the deployment.

RBAC and Policy answer different questions: permission to perform the operation and applicable configuration constraints. Contributor does not bypass a deny policy. Audit records noncompliance without blocking, and a cost-center tag alone is not the complete authorization or compliance mechanism. Source: AZ-305 Study Guide.pdf, PDF page(s) 19.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.