You have a resource group named RG1. Prevent the creation of virtual machines in RG1 while still allowing other resources to be created. What should you use?

An Azure policy is the correct choice because it allows you to define and enforce rules over your resources to ensure compliance with organizational standards. You can create a custom policy definition that specifically denies the creation of virtual machines within RG1. A lock would prevent any modification or deletion of resources within RG1, not just the creation of virtual machines. An Azure role defines permissions for users or groups to perform actions on resources, but it doesn't prevent resource creation based on type. A tag is used for organizing and categorizing resources, not for enforcing creation rules.