Which tool lets you enforce rules like permitted VM sizes or required regions in Azure?

Azure Policy is the correct answer because it's a service used to create, assign, and manage policies that enforce rules and effects over your resources to ensure compliance with corporate standards and service level agreements. This includes defining allowed VM sizes, required regions, and other configuration settings. Azure Monitor is for collecting, analyzing, and acting on telemetry from your Azure and on-premises environments. Azure Key Vault is for securely storing and managing cryptographic keys, secrets, and certificates. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources.