If I read that right, the policy permits the policy for Subscription 1, but excludes ControsoRG1. So the question is set up correctly. Explanation you can find here in the MS docs.
Rob,
according to what i see:
- the policy itself does not allow to build SQL servers in whole subscription.
- exclusion is only ContosoRG1.
which means that correct answer is the one i selected “You can create Azure SQL servers in ContosoRG1 only”
correct me if i am wrong.
I might need a link to the full page for better and more context, but it’s not clear what you mean by “the policy”. But policies tend to allow things, and exclusions would exclude from the policy referred to.