AZ-104 Manage Azure Identities and Governance Practice Test 11 — 15 Questions

Question 1

You need one assignment that requires a cost-center tag and also allows only approved locations. What should you use?

Accepted Answer

A policy initiative. A policy initiative is the correct choice because it allows you to group multiple Azure Policy definitions (such as 'Require a cost-center tag' and 'Allowed locations') into a single, reusable assignment. This ensures both conditions are enforced simultaneously at a scope like a subscription or resource group, meeting the requirement for a cost-center tag and location restriction.

Answer

A role assignment

Answer

A resource lock

Answer

A management group

Question 2

Three Azure virtual machines in different resource groups must all use the same Azure identity to access a storage account. The identity should keep working even if one VM is rebuilt. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is created as a standalone Azure resource and can be assigned to multiple VMs, even across resource groups. It persists independently of any VM lifecycle, so rebuilding a VM does not affect the identity's availability or its permissions to access the storage account.

Answer

A system-assigned managed identity on each VM

Answer

A shared VM administrator password

Answer

A storage account SAS token

Question 3

An external consultant must access a resource group in your tenant using the consultant's existing work account. You want to avoid creating a separate username and password pair. Which two actions should the administrator take? Select two.

Accepted Answer

Invite the consultant as a guest user in Microsoft Entra ID.. Inviting the consultant as a guest user in Microsoft Entra ID (formerly Azure AD) allows the consultant to use their existing work account (external identity) without creating a new username/password. This leverages B2B collaboration, which uses the consultant's home directory for authentication, and the guest user object is created in your tenant to represent them.

Answer

Create a new member user account with an internal password.

Answer

Add the consultant to the Global Administrator role.

Answer

Share the subscription ID and tenant ID only.

Question 4

A compliance team wants to identify all resources in a department that are missing an Environment tag, but they do not want to stop users from creating or changing resources. Which two choices should the administrator make? Select two.

Accepted Answer

Use an Azure Policy assignment with the Audit effect.. The Audit effect in Azure Policy allows the compliance team to identify resources missing an Environment tag without blocking resource creation or modification. This effect logs non-compliant resources to the activity log, enabling visibility without enforcement. Option B is correct because assigning the policy at the management group scope ensures it applies to all subscriptions within that department, covering all resources under a single governance boundary.

Answer

Use the Deny effect.

Answer

Grant Reader on the subscription to the compliance team.

Answer

Apply a ReadOnly lock to all resource groups.

Question 5

A production resource group contains web and data resources. Administrators must be able to update, scale, and restart resources, but they must not delete the resource group or any resource inside it during maintenance windows. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Applying a CanNotDelete lock to the resource group prevents the deletion of the resource group and all resources within it, while still allowing administrators to update, scale, and restart resources. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to perform maintenance actions without risking deletion. The lock is inherited by all child resources in the resource group, ensuring comprehensive protection.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Apply a CanNotDelete lock only to the individual virtual machines.

Answer

Use tags to mark the resources as production and prevent deletion.

Question 6

A platform team wants every current and future subscription under the company's Azure hierarchy to inherit Reader access for a central audit group. The team does not want to create separate assignments for each subscription. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions.. Assigning the Reader role at the management group level ensures that all current and future subscriptions within that management group inherit the assignment via Azure RBAC inheritance. This meets the requirement without needing separate assignments per subscription, as role assignments flow down the hierarchy from management group to subscription to resource group to resource.

Answer

At one subscription and rely on inheritance to reach the others.

Answer

At a resource group in a single subscription.

Answer

At an individual resource that the audit team will inspect.

Question 7

A VM-hosted application must read blobs from Azure Storage without storing any keys or passwords. Which two identity types can the VM use to authenticate to Azure Storage? Select two.

Accepted Answer

System-assigned managed identity, because it is tied to one VM and can request tokens without stored secrets.. System-assigned managed identity is correct because it is directly tied to a single VM and can request tokens from Azure AD without storing any secrets or keys. The VM uses its managed identity to authenticate to Azure Storage by obtaining an OAuth 2.0 token, which is then passed to the storage service via the Authorization header. This eliminates the need for any stored credentials, meeting the requirement of not storing keys or passwords.

Answer

Storage account shared key, because it is the preferred credential when you want to avoid passwords.

Answer

Basic authentication with a storage account name and password, because Azure Storage supports that model directly.

Answer

Anonymous public access, because it lets the VM read blobs without any authentication at all.

Question 8

Based on the exhibit, what should you configure so the analysts can manage group membership without granting Azure resource permissions?

Accepted Answer

Add the service desk analysts as owners of the App-Support group.. Adding the service desk analysts as owners of the App-Support group grants them the ability to manage group membership directly within Microsoft Entra ID (formerly Azure AD) without assigning any Azure RBAC permissions on resources. Group owners can add or remove members from the group, but they do not inherit any permissions to manage Azure resources like VMs or storage accounts.

Answer

Assign the service desk analysts the User Administrator role in Microsoft Entra ID.

Answer

Create separate local administrator accounts for each analyst.

Answer

Assign Contributor on the subscription to the service desk analysts.

Question 9

Finance, HR, and Engineering each use separate subscriptions. The compliance team wants a simple hierarchy that lets them apply governance to groups of subscriptions and produce resource ownership reports by department and environment. Which two features should the administrator use? Select two.

Accepted Answer

Management groups to organize the subscriptions into a hierarchy.. Management groups (A) are correct because they allow you to organize multiple subscriptions into a hierarchical structure for applying governance policies and role-based access control at scale. This directly supports the compliance team's need to apply governance to groups of subscriptions and produce resource ownership reports by department and environment.

Answer

Resource locks to group subscriptions by business unit.

Answer

Availability sets to group applications by department.

Answer

Private endpoints to separate Finance from HR.

Question 10

A compliance report must show which department and environment owns each Azure resource, even when the resources are spread across many resource groups and subscriptions. Which feature should the administrator use?

Accepted Answer

Resource tags.. Resource tags are metadata key-value pairs that can be attached to Azure resources, resource groups, and subscriptions. They allow administrators to logically organize resources by department, environment, cost center, or any custom category, and this metadata is included in compliance reports. Unlike resource group names or management groups, tags are flexible and can be applied across multiple resource groups and subscriptions, making them the correct choice for this requirement.

Answer

Resource group names only.

Answer

Management groups.

Answer

Resource locks.

Question 11

A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Assigning the Contributor role at the VM1 resource scope grants the contractor permissions exclusively to that virtual machine, leaving all other resources in rg-prod and other scopes untouched. This meets the requirement of limiting access to only VM1 and VM2 within rg-prod.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 12

An operations team needs one Azure identity that can be attached to several VMs and kept even if a VM is deleted. Which two statements about a user-assigned managed identity are correct? Select two.

Accepted Answer

It is created as a separate Azure resource.. A user-assigned managed identity is created as a separate Azure resource in its own right, independent of any VM. This means it has its own lifecycle and can be managed (created, deleted, assigned) independently from the VMs it is associated with.

Answer

It is automatically deleted when the first VM is deleted.

Answer

It requires a storage account access key to work.

Answer

It can only be attached to one VM at a time.

Question 13

A web app running on an Azure VM must read files from Azure Blob Storage without storing any passwords, secrets, or access keys on the VM. The identity should be tied to that VM and removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it creates an identity in Azure AD that is tied directly to the lifecycle of the VM. When the VM is deleted, the identity is automatically removed. The VM can use this identity to authenticate to Azure Blob Storage via Azure AD without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) to obtain tokens.

Answer

A shared storage account key in the application settings

Answer

A user account with a local password on the VM

Answer

A service endpoint on the VM subnet

Question 14

A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?

Accepted Answer

A Microsoft Entra ID security group. Assigning the Azure role to a Microsoft Entra ID security group allows the administrator to manage access by adding or removing contractors from the group, rather than editing individual role assignments. This approach ensures that role assignments remain unchanged when contractors leave or join, as the group itself retains the role. It leverages Azure RBAC's support for group-based access control, which is the recommended method for dynamic teams.

Answer

Each contractor user account individually

Answer

A device group

Answer

An Azure subscription

Question 15

Based on the exhibit, which action should the administrator take so Contractor01 can manage the team membership without receiving Azure resource permissions?

Accepted Answer

Add Contractor01 as an owner of the AppOps-Admins group.. Adding Contractor01 as an owner of the AppOps-Admins group grants them the ability to manage group membership (add/remove members) without inheriting any Azure resource permissions. Group ownership is an Azure AD role that controls group administration only, not access to Azure resources like VMs or storage. This meets the requirement of managing team membership without resource permissions.

Answer

Add Contractor01 as a member of the AppOps-Admins group.

Answer

Assign Contractor01 the User Administrator role at the tenant scope.

Answer

Assign Contractor01 Contributor on the subscription.