AZ-104 Manage Azure Identities and Governance Practice Test 11 — 15 Questions

Question 1

An operations team needs one Azure identity that can be attached to several VMs and kept even if a VM is deleted. Which two statements about a user-assigned managed identity are correct? Select two.

Accepted Answer

It is created as a separate Azure resource.. Option A is correct because a user-assigned managed identity is created as a separate Azure resource in its own right, independent of any VM. This means it has its own lifecycle and can be managed (created, deleted, assigned) independently from the VMs it is associated with.

Answer

It is automatically deleted when the first VM is deleted.

Answer

It requires a storage account access key to work.

Answer

It can only be attached to one VM at a time.

Question 2

A web app running on an Azure VM must read files from Azure Blob Storage without storing any passwords, secrets, or access keys on the VM. The identity should be tied to that VM and removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it creates an identity in Azure AD that is tied directly to the lifecycle of the VM. When the VM is deleted, the identity is automatically removed. The VM can use this identity to authenticate to Azure Blob Storage via Azure AD without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) to obtain tokens.

Answer

A shared storage account key in the application settings

Answer

A user account with a local password on the VM

Answer

A service endpoint on the VM subnet

Question 3

A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?

Accepted Answer

A Microsoft Entra ID security group. Assigning the Azure role to a Microsoft Entra ID security group allows the administrator to manage access by adding or removing contractors from the group, rather than editing individual role assignments. This approach ensures that role assignments remain unchanged when contractors leave or join, as the group itself retains the role. It leverages Azure RBAC's support for group-based access control, which is the recommended method for dynamic teams.

Answer

Each contractor user account individually

Answer

A device group

Answer

An Azure subscription

Question 4

Based on the exhibit, which action should the administrator take so Contractor01 can manage the team membership without receiving Azure resource permissions?

Accepted Answer

Add Contractor01 as an owner of the AppOps-Admins group.. Adding Contractor01 as an owner of the AppOps-Admins group grants them the ability to manage group membership (add/remove members) without inheriting any Azure resource permissions. Group ownership is an Azure AD role that controls group administration only, not access to Azure resources like VMs or storage. This meets the requirement of managing team membership without resource permissions.

Answer

Add Contractor01 as a member of the AppOps-Admins group.

Answer

Assign Contractor01 the User Administrator role at the tenant scope.

Answer

Assign Contractor01 Contributor on the subscription.

Question 5

A web API runs on a single Azure VM and must access Azure Key Vault without storing any credentials on the VM. The identity should be tied to that VM and removed when the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — it is created when the VM is provisioned and automatically deleted when the VM is deleted. This identity can be used to authenticate to Azure Key Vault without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens. This matches the requirement that the identity be removed when the VM is deleted.

Answer

A user-assigned managed identity

Answer

A storage account shared access signature

Answer

A local administrator account with a strong password

Question 6

A VM-hosted app must read blobs from Azure Storage without storing a shared key, SAS token, or password. Which two configuration steps should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Azure to automatically manage a service principal for the VM, eliminating the need for any stored credentials. By assigning the Storage Blob Data Reader role to that identity on the storage account, the VM can authenticate to Azure Storage using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint, without ever storing a shared key, SAS token, or password.

Answer

Store the storage account access key in the app configuration.

Answer

Generate a SAS token and embed it in the application code.

Answer

Move the VM into a different subnet.

Question 7

A partner company needs a developer to access resources in your tenant by using the developer's existing work account. You do not want to create a new separate username and password for that person. What should you create in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because Microsoft Entra ID B2B collaboration allows you to invite an external user's existing work account as a guest user. This grants access to resources without creating a new username and password, as the developer authenticates using their home tenant credentials. Guest users are managed in Entra ID and can be assigned permissions via Azure RBAC or group membership.

Answer

A local user account in each resource group

Answer

A managed identity

Answer

A new service principal

Question 8

Based on the exhibit, which identity approach should the administrator use so both VMs can share the same access without managing secrets or recreating role assignments when a VM is replaced?

Accepted Answer

A single user-assigned managed identity attached to both VMs.. A user-assigned managed identity is an independent Azure resource that can be attached to multiple VMs, allowing them to share the same identity for accessing Azure resources. This approach eliminates the need to manage secrets (like passwords or keys) and avoids recreating role assignments when a VM is replaced, because the identity persists independently of the VM lifecycle.

Answer

A separate system-assigned managed identity on each VM.

Answer

An administrator username and password stored in the script.

Answer

A shared access signature assigned to the virtual network.

Question 9

A company has 18 subscriptions under a management group named Corp. The audit team needs Reader access to all current and future subscriptions in Corp without creating one assignment per subscription. Which two statements are correct? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope is correct because Azure RBAC allows role assignments to be inherited by all child resources, including all current and future subscriptions under that management group. This eliminates the need to create a separate assignment per subscription, as the single assignment at the management group level applies to all subscriptions within it.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader at one resource group in each subscription.

Answer

Create a lock on each subscription to provide Reader access.

Question 10

A team needs Reader access to exactly two Azure resources that are in the same resource group, and they must not gain access to other resources in that group. Which two scope choices are appropriate? Select two.

Accepted Answer

Assign the role at the storage account scope.. Assigning the Reader role at the storage account scope (Option A) grants read-only access to exactly that storage account, and no other resources in the resource group. This is because Azure RBAC scopes are hierarchical, and a role assignment at a specific resource scope limits permissions to only that resource. Therefore, this meets the requirement of providing access to exactly two resources without granting access to others in the same resource group.

Answer

Assign the role at the resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 11

A subscription must block creation of resources in any region except East US and West US, and the security team also wants a nonblocking report of existing resources that are missing a CostCenter tag. Which two Azure Policy effects should you use? Select two.

Accepted Answer

Deny. Deny is correct because it actively blocks resource creation in regions outside East US and West US by evaluating the location property against an allowed list and rejecting non-compliant requests at deployment time. Audit is correct because it logs a compliance event for existing resources missing the CostCenter tag without blocking any operations, providing a nonblocking report for the security team.

Answer

Modify

Answer

DeployIfNotExists

Answer

Disabled

Question 12

The service desk needs to add and remove users from a support group that grants access to an internal application, but the service desk must not receive Azure subscription permissions. Which two actions should you take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the application access.. Option A is correct because creating a security group in Microsoft Entra ID (formerly Azure AD) allows you to manage access to the internal application without granting any Azure subscription permissions. The service desk can then add or remove users from this group, and the application's access control can be configured to rely on group membership, ensuring the service desk staff never receive Azure RBAC roles.

Answer

Assign the service desk staff Contributor on the subscription.

Answer

Convert the service desk staff into guest users in the tenant.

Answer

Add the service desk staff as members only, without ownership.

Question 13

Based on the exhibit, which identity should be enabled on the VM so the application can access Azure Blob Storage and the identity disappears when the VM is deleted?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It can be granted access to Azure Blob Storage via Azure RBAC, allowing the application to authenticate without storing credentials. This matches the requirement for an identity that disappears with the VM.

Answer

User-assigned managed identity

Answer

Storage account shared key

Answer

SAS token stored in a startup script

Question 14

A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.

Answer

Audit

Answer

Append

Answer

Disabled

Question 15

A project team adds and removes contractors every month. The team wants Azure role assignments to stay the same when individual contractors leave or join, and access should be granted to everyone on the team through one control point. What should the administrator assign the Azure role to?

Accepted Answer

A Microsoft Entra security group. Assigning an Azure role to a Microsoft Entra security group provides a single control point for managing permissions. When contractors join or leave, the administrator only needs to add or remove their user accounts from the group, and the role assignments remain intact. This decouples access from individual user accounts and ensures consistent permissions for the entire team.

Answer

A Microsoft 365 group

Answer

A guest user account

Answer

A managed identity