AZ-104 Manage Azure Identities and Governance Practice Test 10 — 15 Questions

Question 1

Three application VMs in different resource groups must use the same Azure identity to read blobs from a storage account. The identity must continue to work if the VMs are redeployed. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be assigned to multiple VMs across different resource groups. It persists independently of the VM lifecycle, so it continues to work even if the VMs are redeployed, and it can be used to authenticate to Azure Storage for blob read operations via Microsoft Entra ID.

Answer

A system-assigned managed identity on each VM

Answer

A shared access signature stored in a configuration file

Answer

The local Administrator account on each VM

Question 2

A service desk must grant and revoke access to an internal application for a changing group of employees. The service desk must not receive any Azure subscription or resource permissions. Which two actions should you take? Select two.

Accepted Answer

Use a Microsoft Entra security group to represent application access.. Option A is correct because a Microsoft Entra security group is the standard directory object used to represent a set of users who need the same application access; membership changes grant or revoke access without touching Azure resource permissions. Option B is correct because making the service desk an owner of that security group lets them add and remove members (grant/revoke access) while the ownership is scoped only to the group, so they receive no Azure subscription or resource permissions. Option C is wrong because the Contributor role on the resource group grants broad Azure resource management permissions, which the scenario explicitly forbids. Option D is wrong because the User Administrator directory role is a privileged Entra role that can manage users and is far broader than needed, and it is not an Azure resource role but still exceeds the least-privilege requirement. Option E is wrong because managing individual per-user assignments is operationally inefficient for a changing group and does not leverage group-based access.

Answer

Assign the service desk the Contributor role on the application resource group.

Answer

Assign the service desk the User Administrator directory role to manage the application users.

Answer

Create individual user assignments for every employee instead of using group-based access.

Question 3

A web application is made up of several Azure resources that are deployed, updated, and retired together. The team wants one container for applying access control, tags, and deletion protection consistently to the whole application. What should they use?

Accepted Answer

A resource group.. A resource group is the correct container because it is a logical grouping of Azure resources that share the same lifecycle, allowing you to apply access control (RBAC), tags, and deletion protection (resource locks) consistently to all resources within the group. This aligns with the requirement to deploy, update, and retire resources together as a single unit.

Answer

A subscription dedicated to the application.

Answer

A management group.

Answer

A tag value that names the application.

Question 4

An external consultant from another company needs read-only access to a resource group and must sign in with their own work account. What should be created in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because a guest user account in Microsoft Entra ID (formerly Azure AD) allows an external user from another organization to sign in using their own work account (via B2B collaboration) and be granted read-only access to a specific resource group. This leverages the existing identity provider of the external consultant, eliminating the need to create a separate identity in the company tenant.

Answer

A member user account in the company tenant

Answer

A Microsoft 365 group

Answer

A service principal

Question 5

Based on the exhibit, which identity should be granted the Contributor role so access can be managed centrally as team members change?

Accepted Answer

Assign Contributor to a Microsoft Entra security group that contains the team members.. Assigning the Contributor role to a Microsoft Entra security group that contains the team members allows access to be managed centrally. As team members join or leave, you simply add or remove them from the group, and their permissions update automatically without needing to modify role assignments for each individual user. This aligns with Azure RBAC best practices for centralized identity governance.

Answer

Assign Contributor to each user account individually.

Answer

Assign Contributor to a managed identity.

Answer

Assign Contributor to the management group that contains rg-app.

Question 6

A company has many subscriptions arranged under a management group named Corp. The audit team needs Reader access to every current and future subscription in Corp, and the administrator wants only one role assignment to maintain. Which two actions should be taken? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Option A is correct because assigning the Reader role at the Corp management group scope grants inherited access to every subscription currently under that management group, satisfying the requirement for a single role assignment to maintain. Option B is correct because Azure RBAC inheritance flows from the management group down to subscriptions, so any existing or future subscription must remain (or be placed) under Corp for that single assignment to cover it. Option C is wrong because per-subscription assignments would require many role assignments, contradicting the one-assignment requirement. Option D is wrong because assigning at the tenant root would grant access far beyond Corp and removing the management group defeats the intended scope. Option E is wrong because resource-group-level assignments do not cover entire subscriptions and would require many assignments.

Answer

Assign Reader separately on each subscription.

Answer

Assign Reader at the tenant root and remove the management group.

Answer

Create a resource group for each subscription and assign Reader there.

Question 7

A project team adds and removes contractors every few weeks. The team needs Azure access to follow membership changes without updating role assignments for each person. What should the administrator use to delegate the access?

Accepted Answer

Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.. Assigning an Azure role to a Microsoft Entra security group allows the administrator to manage access by simply adding or removing contractors from the group, without needing to update role assignments for each individual. This leverages Azure RBAC's support for group-based assignments, which automatically propagate role permissions to new members and revoke them from removed members.

Answer

Assign the Azure role directly to each contractor user account.

Answer

Use a Microsoft 365 group and assign the Azure role to it.

Answer

Create a management group for the contractors and assign the role there.

Question 8

A department has 12 subscriptions under a management group named Corp. New resources must be deployed only in East US or West US and must include a CostCenter tag. A pilot subscription must be exempt from these rules during testing. Which two actions should you take? Select two.

Accepted Answer

Assign an initiative containing both policy definitions at the Corp management-group scope.. Assigning an initiative (a collection of policy definitions) at the Corp management-group scope ensures that all 12 subscriptions inherit both the location restriction and the CostCenter tag requirement. This is the most efficient and scalable way to enforce governance across multiple subscriptions without repeating assignments.

Answer

Assign the policies individually at each resource group.

Answer

Use the Owner role at the management-group scope.

Answer

Use a resource lock instead of Azure Policy.

Question 9

Based on the exhibit, where should the Network Contributor role be assigned so the engineer can manage only VNet-vm and its subnets, but not other resources in rg-platform?

Accepted Answer

Assign Network Contributor at the VNet-vm resource scope.. Assigning the Network Contributor role at the VNet-vm resource scope grants the engineer permissions to manage only that specific virtual network and its subnets, while preventing any access to other resources within the rg-platform resource group. This follows the principle of least privilege by scoping the role assignment to the exact resource that needs to be managed.

Answer

Assign Network Contributor at the management group scope.

Answer

Assign Network Contributor at the subscription scope.

Answer

Assign Network Contributor at the resource group scope for rg-platform.

Question 10

A contractor pool changes every month. The operations team wants Azure role access to stay the same when people join or leave, without editing role assignments for each person. Which two actions should the administrator take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the contractor pool.. Creating a security group in Microsoft Entra ID (formerly Azure AD) allows the administrator to manage membership dynamically or manually as contractors join or leave. By assigning the Azure role to this security group (Option D), role assignments remain constant; only group membership changes, eliminating the need to edit individual role assignments. This approach leverages Azure RBAC's support for security groups as assignable principals, ensuring consistent access control.

Answer

Assign the Azure role directly to each contractor account.

Answer

Create a Microsoft 365 group and use it for VM sign-in.

Answer

Use a user-assigned managed identity for each contractor.

Question 11

Based on the exhibit, which Azure feature should the administrator add so ownership and chargeback information remains visible even if resources are moved between resource groups?

Accepted Answer

Tags. Tags are metadata key-value pairs that can be assigned to Azure resources and resource groups. They persist even when resources are moved between resource groups, making them ideal for tracking ownership and chargeback information across organizational boundaries. Unlike other options, tags are specifically designed for cost tracking, ownership attribution, and resource categorization.

Answer

Management groups

Answer

Resource locks

Answer

Role assignments

Question 12

A company wants to group several subscriptions for Finance, HR, and Engineering so that the same governance settings can be applied above the subscription level. What should the administrator create?

Accepted Answer

A management group. A management group is the correct choice because it allows you to organize multiple Azure subscriptions into a hierarchy and apply governance policies, role-based access control (RBAC), and compliance settings at a scope above the subscription level. By creating a management group for Finance, HR, and Engineering, the administrator can enforce consistent Azure Policy initiatives and RBAC assignments across all three subscriptions, ensuring uniform governance without needing to configure each subscription individually.

Answer

A resource group

Answer

A tag

Answer

A resource lock

Question 13

A contractor must manage only VM1 and VM2 in rg-prod. The contractor must not be able to manage any other resource in the resource group. Which two role assignment scopes should you create? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Assigning the role at the VM1 resource scope (Option A) is correct because Azure RBAC allows you to scope a role assignment to an individual resource, such as a virtual machine. This grants the contractor permissions to manage only VM1, without affecting any other resources in the resource group. The same logic applies to VM2, making the resource-level scope the precise way to restrict management to just those two VMs.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 14

A production resource group must not be deleted accidentally, but administrators still need to update resources inside it. Which lock should you apply to the resource group?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it prevents deletion of the resource group while still allowing all other operations, including updates to resources within it. This lock type is specifically designed to protect against accidental deletion without blocking read, write, or modify actions, which aligns perfectly with the requirement that administrators need to update resources inside the group.

Answer

ReadOnly lock

Answer

Contributor role

Answer

Azure Policy deny assignment

Question 15

A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?

Accepted Answer

At the rg-finance-app resource group scope.. The Contributor role must be assigned at the rg-finance-app resource group scope to restrict permissions exclusively to that group. This ensures the team can manage only the resources within that resource group, without inheriting permissions to other resource groups in the subscription. Role assignments in Azure are inherited from higher scopes (management group, subscription) down to lower scopes, so assigning at the resource group scope is the most specific and restrictive level that meets the requirement.

Answer

At the management group that contains the subscription.

Answer

At the subscription scope.

Answer

At each individual resource in the resource group.