AZ-104 Manage Azure Identities and Governance Practice Test 12 — 15 Questions

Question 1

A web API runs on a single Azure VM and must access Azure Key Vault without storing any credentials on the VM. The identity should be tied to that VM and removed when the VM is deleted. What should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — it is created when the VM is provisioned and automatically deleted when the VM is deleted. This identity can be used to authenticate to Azure Key Vault without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens. This matches the requirement that the identity be removed when the VM is deleted.

Answer

A user-assigned managed identity

Answer

A storage account shared access signature

Answer

A local administrator account with a strong password

Question 2

A VM-hosted app must read blobs from Azure Storage without storing a shared key, SAS token, or password. Which two configuration steps should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Azure to automatically manage a service principal for the VM, eliminating the need for any stored credentials. By assigning the Storage Blob Data Reader role to that identity on the storage account, the VM can authenticate to Azure Storage using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint, without ever storing a shared key, SAS token, or password.

Answer

Store the storage account access key in the app configuration.

Answer

Generate a SAS token and embed it in the application code.

Answer

Move the VM into a different subnet.

Question 3

A partner company needs a developer to access resources in your tenant by using the developer's existing work account. You do not want to create a new separate username and password for that person. What should you create in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because Microsoft Entra ID B2B collaboration allows you to invite an external user's existing work account as a guest user. This grants access to resources without creating a new username and password, as the developer authenticates using their home tenant credentials. Guest users are managed in Entra ID and can be assigned permissions via Azure RBAC or group membership.

Answer

A local user account in each resource group

Answer

A managed identity

Answer

A new service principal

Question 4

Based on the exhibit, which identity approach should the administrator use so both VMs can share the same access without managing secrets or recreating role assignments when a VM is replaced?

Accepted Answer

A single user-assigned managed identity attached to both VMs.. A user-assigned managed identity is an independent Azure resource that can be attached to multiple VMs, allowing them to share the same identity for accessing Azure resources. This approach eliminates the need to manage secrets (like passwords or keys) and avoids recreating role assignments when a VM is replaced, because the identity persists independently of the VM lifecycle.

Answer

A separate system-assigned managed identity on each VM.

Answer

An administrator username and password stored in the script.

Answer

A shared access signature assigned to the virtual network.

Question 5

A company has 18 subscriptions under a management group named Corp. The audit team needs Reader access to all current and future subscriptions in Corp without creating one assignment per subscription. Which two statements are correct? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope is correct because Azure RBAC allows role assignments to be inherited by all child resources, including all current and future subscriptions under that management group. This eliminates the need to create a separate assignment per subscription, as the single assignment at the management group level applies to all subscriptions within it.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader at one resource group in each subscription.

Answer

Create a lock on each subscription to provide Reader access.

Question 6

A subscription must block creation of resources in any region except East US and West US, and the security team also wants a nonblocking report of existing resources that are missing a CostCenter tag. Which two Azure Policy effects should you use? Select two.

Accepted Answer

Deny. Deny is correct because it actively blocks resource creation in regions outside East US and West US by evaluating the location property against an allowed list and rejecting non-compliant requests at deployment time. Audit is correct because it logs a compliance event for existing resources missing the CostCenter tag without blocking any operations, providing a nonblocking report for the security team.

Answer

Modify

Answer

DeployIfNotExists

Answer

Disabled

Question 7

The service desk needs to add and remove users from a support group that grants access to an internal application, but the service desk must not receive Azure subscription permissions. Which two actions should you take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the application access.. Creating a security group in Microsoft Entra ID (formerly Azure AD) allows you to manage access to the internal application without granting any Azure subscription permissions. The service desk can then add or remove users from this group, and the application's access control can be configured to rely on group membership, ensuring the service desk staff never receive Azure RBAC roles.

Answer

Assign the service desk staff Contributor on the subscription.

Answer

Convert the service desk staff into guest users in the tenant.

Answer

Add the service desk staff as members only, without ownership.

Question 8

Based on the exhibit, which identity should be enabled on the VM so the application can access Azure Blob Storage and the identity disappears when the VM is deleted?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It can be granted access to Azure Blob Storage via Azure RBAC, allowing the application to authenticate without storing credentials. This matches the requirement for an identity that disappears with the VM.

Answer

User-assigned managed identity

Answer

Storage account shared key

Answer

SAS token stored in a startup script

Question 9

A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.

Answer

Audit

Answer

Append

Answer

Disabled

Question 10

A department wants three related policies grouped together and assigned as one unit to a set of subscriptions. Which two statements about an Azure Policy initiative are correct? Select two.

Accepted Answer

An initiative groups multiple policy definitions into one assignment.. An Azure Policy initiative is specifically designed to group multiple policy definitions into a single assignment. This allows you to apply a set of related compliance rules as one unit, simplifying management and ensuring consistent enforcement across subscriptions.

Answer

An initiative grants Azure permissions to users.

Answer

An initiative replaces resource group locks.

Answer

An initiative is used to create a new resource group.

Question 11

Three VMs run the same batch app and should use the same Azure identity to read blobs. The identity should remain available even if one VM is deleted. Which identity should you use?

Accepted Answer

User-assigned managed identity. C is correct because a user-assigned managed identity is an independent Azure resource that persists even if a specific VM is deleted. This allows multiple VMs to share the same identity to authenticate to Azure Blob Storage, ensuring continuous access to blobs as long as at least one VM remains.

Answer

Shared access signature (SAS) token

Answer

System-assigned managed identity

Answer

Storage account shared key

Question 12

Three Azure VMs in separate resource groups run the same data-processing agent. The agent must read blobs from a storage account, and the access must continue to work if any VM is rebuilt or replaced. The operations team also wants one identity they can reassign to future VMs without creating another credential. Which identity approach should be used?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity (D) is the correct choice because it is a standalone Azure resource that can be created independently and then attached to multiple VMs. If a VM is rebuilt or replaced, the same user-assigned identity can be reassigned to the new VM without any credential rotation or secret management. This ensures continuous blob access via Azure AD authentication, meeting the requirement for a single, reusable identity.

Answer

A system-assigned managed identity on each VM.

Answer

A storage account shared key embedded in the application settings.

Answer

A service principal credential stored in a Key Vault secret.

Question 13

Based on the exhibit, which Azure Policy construct should the administrator use to deploy and manage these guardrails as one unit across the department?

Accepted Answer

Create an Azure Policy initiative and assign it at the management group scope.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for deployment as a single unit. By assigning the initiative at the management group scope, the administrator can enforce consistent guardrails across all subscriptions within that management group, ensuring centralized governance and compliance for the entire department.

Answer

Create an Azure RBAC role assignment at the management group scope.

Answer

Apply a ReadOnly lock to each subscription.

Answer

Move all resources into one resource group.

Question 14

Based on the exhibit, where should the Reader role be assigned so the audit team automatically has access to every current and future subscription under Corp?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope uses Azure RBAC inheritance to grant the audit team read-only access to all current and future subscriptions under that management group. Because management group scope propagates role assignments to all child subscriptions and resource groups, this ensures automatic coverage without manual updates.

Answer

Assign Reader at the subscription scope for Sub-001.

Answer

Assign Reader at the resource group scope in each subscription.

Answer

Assign Reader directly to each resource that the audit team might review.

Question 15

An operations team must enforce two rules across all subscriptions in a department: new resources must include a CostCenter tag, and deployments are allowed only in East US and West US. The team wants one assignment and automatic blocking of noncompliant deployments. Which three actions should the administrator take? Select three.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. An Azure Policy initiative (a set of policy definitions) allows combining the CostCenter tag requirement and the allowed region restriction into a single assignment, simplifying management. This ensures both rules are enforced together across all subscriptions in the department.

Answer

Grant Contributor at the subscription scope.

Answer

Apply a CanNotDelete lock to each resource group.