Which Azure service can restrict resource access based on a user's department and role?

Azure AD Conditional Access is the correct answer because it allows you to enforce policies that evaluate conditions like user group (department), role, location, device, and application to grant or block access to resources. This directly addresses the requirement of restricting access based on a user's department and role. Azure Tags are used for organizing and categorizing resources, not for enforcing access control. Azure App Gateway is a web traffic load balancer that enables you to manage traffic to your web applications, but it doesn't restrict access based on user attributes like department or role. Azure DNS provides domain name resolution and doesn't offer access control features for resources.