AZ-104 Manage Azure Identities and Governance Practice Test 11 — 15 Questions

Question 1

A company wants to stop users from deploying resources in any region except East US and West US. Users still need to be able to create resources if they choose an approved region. Which Azure feature should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy with a deny effect assigned at the appropriate scope.. Azure Policy with a deny effect can enforce that resource deployments are only allowed in specified regions (East US and West US) by evaluating the location property of the resource against a policy definition. When a user attempts to deploy a resource in a non-approved region, the policy engine rejects the request before any resource creation begins, ensuring compliance without blocking approved regions.

Answer

Azure RBAC with a Contributor role at the subscription scope.

Answer

A resource lock at the subscription level.

Answer

A tag requirement in Azure RBAC.

Question 2

A project team adds and removes contractors every month. The admin wants Azure access to update automatically when membership changes without editing role assignments for each person. Which two actions should the admin take? Select two.

Accepted Answer

Create a Microsoft Entra ID security group for the contractors.. Creating a Microsoft Entra ID security group for contractors allows the admin to manage membership dynamically. When contractors are added or removed from the group, their Azure access updates automatically without needing to edit individual role assignments. This leverages group-based RBAC, where the group is assigned the role, and membership changes propagate to Azure RBAC.

Answer

Assign the Azure RBAC role directly to each contractor user account.

Answer

Create a management group for the contractors.

Answer

Use a resource lock to control access.

Question 3

A team needs to understand Azure RBAC inheritance. Which two statements are correct? Select two.

Accepted Answer

A role assignment at a resource group scope applies to resources inside that group.. Azure RBAC inheritance follows a hierarchical scope model: a role assignment at a resource group scope applies to all resources within that resource group, as the resource group is the parent scope for its child resources. This means any user or group assigned a role at the resource group level automatically inherits those permissions for every resource (e.g., VMs, storage accounts) inside that group, without needing separate assignments.

Answer

A role assignment at a resource scope automatically applies to all other resources in the subscription.

Answer

A role assignment at management group scope applies only to the subscription where it was created.

Answer

A role assignment at a resource group scope is broader than a subscription scope.

Question 4

An application team needs Contributor access only for the resources in rg-app. They must not manage any other resources in the subscription. At what scope should you assign the role?

Accepted Answer

Resource group scope. The Contributor role assigned at the resource group scope grants the application team full management access to all resources within rg-app, but no access to resources in other resource groups or at the subscription level. This meets the requirement of restricting permissions to only that specific resource group.

Answer

Management group scope

Answer

Subscription scope

Answer

Resource scope

Question 5

A platform team wants to prevent engineers from creating VM sizes that are not approved, but they also need the engineers to be able to restart their own VMs. Which two statements are correct? Select two.

Accepted Answer

Use Azure Policy to deny creation of nonapproved VM sizes.. Azure Policy can enforce organizational standards by denying the creation of non-approved VM sizes through built-in policies like 'Allowed virtual machine SKUs'. This prevents engineers from provisioning unapproved VM sizes at the time of creation, ensuring compliance without blocking other actions. Option B is correct because Azure RBAC allows granular permission assignment, such as granting the 'Microsoft.Compute/virtualMachines/restart/action' to engineers, enabling them to restart their own VMs without granting broader management rights.

Answer

Use Azure Policy to grant restart permission when the VM is compliant.

Answer

Use a resource lock to approve only specific VM sizes.

Answer

Use tags to enforce the approved VM size list and restart action.

Question 6

You need one assignment that requires a cost-center tag and also allows only approved locations. What should you use?

Accepted Answer

A policy initiative. A policy initiative is the correct choice because it allows you to group multiple Azure Policy definitions (such as 'Require a cost-center tag' and 'Allowed locations') into a single, reusable assignment. This ensures both conditions are enforced simultaneously at a scope like a subscription or resource group, meeting the requirement for a cost-center tag and location restriction.

Answer

A role assignment

Answer

A resource lock

Answer

A management group

Question 7

Three Azure virtual machines in different resource groups must all use the same Azure identity to access a storage account. The identity should keep working even if one VM is rebuilt. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is created as a standalone Azure resource and can be assigned to multiple VMs, even across resource groups. It persists independently of any VM lifecycle, so rebuilding a VM does not affect the identity's availability or its permissions to access the storage account.

Answer

A system-assigned managed identity on each VM

Answer

A shared VM administrator password

Answer

A storage account SAS token

Question 8

An external consultant must access a resource group in your tenant using the consultant's existing work account. You want to avoid creating a separate username and password pair. Which two actions should the administrator take? Select two.

Accepted Answer

Invite the consultant as a guest user in Microsoft Entra ID.. Inviting the consultant as a guest user in Microsoft Entra ID (formerly Azure AD) allows the consultant to use their existing work account (external identity) without creating a new username/password. This leverages B2B collaboration, which uses the consultant's home directory for authentication, and the guest user object is created in your tenant to represent them.

Answer

Create a new member user account with an internal password.

Answer

Add the consultant to the Global Administrator role.

Answer

Share the subscription ID and tenant ID only.

Question 9

A compliance team wants to identify all resources in a department that are missing an Environment tag, but they do not want to stop users from creating or changing resources. Which two choices should the administrator make? Select two.

Accepted Answer

Use an Azure Policy assignment with the Audit effect.. The Audit effect in Azure Policy allows the compliance team to identify resources missing an Environment tag without blocking resource creation or modification. This effect logs non-compliant resources to the activity log, enabling visibility without enforcement. Option B is correct because assigning the policy at the management group scope ensures it applies to all subscriptions within that department, covering all resources under a single governance boundary.

Answer

Use the Deny effect.

Answer

Grant Reader on the subscription to the compliance team.

Answer

Apply a ReadOnly lock to all resource groups.

Question 10

A production resource group contains web and data resources. Administrators must be able to update, scale, and restart resources, but they must not delete the resource group or any resource inside it during maintenance windows. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Applying a CanNotDelete lock to the resource group prevents the deletion of the resource group and all resources within it, while still allowing administrators to update, scale, and restart resources. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to perform maintenance actions without risking deletion. The lock is inherited by all child resources in the resource group, ensuring comprehensive protection.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Apply a CanNotDelete lock only to the individual virtual machines.

Answer

Use tags to mark the resources as production and prevent deletion.

Question 11

A platform team wants every current and future subscription under the company's Azure hierarchy to inherit Reader access for a central audit group. The team does not want to create separate assignments for each subscription. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions.. Assigning the Reader role at the management group level ensures that all current and future subscriptions within that management group inherit the assignment via Azure RBAC inheritance. This meets the requirement without needing separate assignments per subscription, as role assignments flow down the hierarchy from management group to subscription to resource group to resource.

Answer

At one subscription and rely on inheritance to reach the others.

Answer

At a resource group in a single subscription.

Answer

At an individual resource that the audit team will inspect.

Question 12

A VM-hosted application must read blobs from Azure Storage without storing any keys or passwords. Which two identity types can the VM use to authenticate to Azure Storage? Select two.

Accepted Answer

System-assigned managed identity, because it is tied to one VM and can request tokens without stored secrets.. System-assigned managed identity is correct because it is directly tied to a single VM and can request tokens from Microsoft Entra ID without storing any secrets or keys. The VM uses its managed identity to authenticate to Azure Storage by obtaining an OAuth 2.0 token, which is then passed to the storage service via the Authorization header. This eliminates the need for any stored credentials, meeting the requirement of not storing keys or passwords.

Answer

Storage account shared key, because it is the preferred credential when you want to avoid passwords.

Answer

Basic authentication with a storage account name and password, because Azure Storage supports that model directly.

Answer

Anonymous public access, because it lets the VM read blobs without any authentication at all.

Question 13

Based on the exhibit, what should you configure so the analysts can manage group membership without granting Azure resource permissions?

Accepted Answer

Add the service desk analysts as owners of the App-Support group.. Adding the service desk analysts as owners of the App-Support group grants them the ability to manage group membership directly within Microsoft Entra ID (formerly Azure AD) without assigning any Azure RBAC permissions on resources. Group owners can add or remove members from the group, but they do not inherit any permissions to manage Azure resources like VMs or storage accounts.

Answer

Assign the service desk analysts the User Administrator role in Microsoft Entra ID.

Answer

Create separate local administrator accounts for each analyst.

Answer

Assign Contributor on the subscription to the service desk analysts.

Question 14

Finance, HR, and Engineering each use separate subscriptions. The compliance team wants a simple hierarchy that lets them apply governance to groups of subscriptions and produce resource ownership reports by department and environment. Which two features should the administrator use? Select two.

Accepted Answer

Management groups to organize the subscriptions into a hierarchy.. Management groups (A) are the correct Azure construct for building a hierarchy above subscriptions, so Finance, HR, and Engineering subscriptions can be nested under a department structure and inherit governance (Azure Policy, RBAC) at each level. Tags (B) are key-value metadata that let the team record department and environment on resources, enabling cost and ownership reports filtered by those values. Resource locks (C) only prevent modification or deletion of individual resources and cannot group subscriptions by business unit. Availability sets (D) are a compute construct for VM fault/update domain resiliency within a region, not an organizational grouping. Private endpoints (E) provide private network connectivity to PaaS services and do not separate or organize subscriptions.

Answer

Resource locks to group subscriptions by business unit.

Answer

Availability sets to group applications by department.

Answer

Private endpoints to separate Finance from HR.

Question 15

A compliance report must show which department and environment owns each Azure resource, even when the resources are spread across many resource groups and subscriptions. Which feature should the administrator use?

Accepted Answer

Resource tags.. Resource tags are metadata key-value pairs that can be attached to Azure resources, resource groups, and subscriptions. They allow administrators to logically organize resources by department, environment, cost center, or any custom category, and this metadata is included in compliance reports. Unlike resource group names or management groups, tags are flexible and can be applied across multiple resource groups and subscriptions, making them the correct choice for this requirement.

Answer

Resource group names only.

Answer

Management groups.

Answer

Resource locks.