A city security baseline must deny creation of public IP addresses in a production subscription. Which Azure capability’s purpose best matches enforcing that resource configuration rule?
Select an answer to reveal the explanation.
Short Explanation
Want to stop someone from hanging a public IP on a city server? That is Azure Policy—rules about what resources are allowed to look like. Tags label; they do not deny. Purview is data, not NIC rules.
Full Explanation
Azure Policy evaluates Azure resources against defined rules and can deny or otherwise govern noncompliant configurations. A city security baseline that must deny creation of public IP addresses in production is a resource-configuration enforcement scenario: Policy inspects properties such as public IP resource types or NIC configurations and applies effects like Deny so noncompliant deployments fail before they expand the attack surface.
Tags only label resources after (or as) they exist; they do not themselves deny public IP creation. Microsoft Purview sensitivity labels belong to data-governance themes and do not replace Policy for network-interface or public-IP configuration rules. Azure Advisor recommendations about unused disks are cost/optimization guidance and do not enforce a deny-on-create public IP baseline.
Exam caveat: Policy assignment scope and effect matter—Audit reports drift without blocking it, while Deny blocks noncompliant creates; choose the effect that matches whether you want visibility or hard prevention. Operational check: assign a deny-public-IP (or equivalent allowed-resource) policy at the production subscription or management group in a test subscription first, attempt to create a public IP, confirm the deployment is denied, then review Compliance to see the noncompliant attempt recorded.