AZ-104 Manage Azure Identities and Governance Practice Test 12 — 15 Questions

Question 1

A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the role at the VM1 resource scope.. Options A and B are correct because Azure RBAC role assignments can be scoped directly to an individual resource, so assigning Contributor at the VM1 resource scope (A) grants the contractor Contributor permissions on VM1 only, and assigning Contributor at the VM2 resource scope (B) grants Contributor permissions on VM2 only; neither assignment propagates to any other resource in rg-prod or to any other resource group or subscription. This precisely satisfies the requirement that the contractor have Contributor on only VM1 and VM2 while all other resources in rg-prod remain untouched and no access is gained elsewhere. Option C is incorrect because assigning Contributor at the rg-prod resource group scope would grant Contributor over every resource in rg-prod, not just VM1 and VM2. Option D is incorrect because a subscription-scope assignment would grant Contributor across all resource groups and resources in the subscription. Option E is incorrect because a management group scope would grant Contributor across all subscriptions and resource groups under that management group, which is far broader than required.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 2

An operations team needs one Azure identity that can be attached to several VMs and kept even if a VM is deleted. Which two statements about a user-assigned managed identity are correct? Select two.

Accepted Answer

It is created as a separate Azure resource.. A user-assigned managed identity is created as a separate Azure resource in its own right, independent of any VM. This means it has its own lifecycle and can be managed (created, deleted, assigned) independently from the VMs it is associated with.

Answer

It is automatically deleted when the first VM is deleted.

Answer

It requires a storage account access key to work.

Answer

It can only be attached to one VM at a time.

Question 3

A web app running on an Azure VM must read files from Azure Blob Storage without storing any passwords, secrets, or access keys on the VM. The identity should be tied to that VM and removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it creates an identity in Microsoft Entra ID that is tied directly to the lifecycle of the VM. When the VM is deleted, the identity is automatically removed. The VM can use this identity to authenticate to Azure Blob Storage via Microsoft Entra ID without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) to obtain tokens.

Answer

A shared storage account key in the application settings

Answer

A user account with a local password on the VM

Answer

A service endpoint on the VM subnet

Question 4

A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?

Accepted Answer

A Microsoft Entra ID security group. Assigning the Azure role to a Microsoft Entra ID security group allows the administrator to manage access by adding or removing contractors from the group, rather than editing individual role assignments. This approach ensures that role assignments remain unchanged when contractors leave or join, as the group itself retains the role. It leverages Azure RBAC's support for group-based access control, which is the recommended method for dynamic teams.

Answer

Each contractor user account individually

Answer

A device group

Answer

An Azure subscription

Question 5

Based on the exhibit, which action should the administrator take so Contractor01 can manage the team membership without receiving Azure resource permissions?

Accepted Answer

Add Contractor01 as an owner of the AppOps-Admins group.. Adding Contractor01 as an owner of the AppOps-Admins group grants them the ability to manage group membership (add/remove members) without inheriting any Azure resource permissions. Group ownership is an Microsoft Entra ID role that controls group administration only, not access to Azure resources like VMs or storage. This meets the requirement of managing team membership without resource permissions.

Answer

Add Contractor01 as a member of the AppOps-Admins group.

Answer

Assign Contractor01 the User Administrator role at the tenant scope.

Answer

Assign Contractor01 Contributor on the subscription.

Question 6

A web API runs on a single Azure VM and must access Azure Key Vault without storing any credentials on the VM. The identity should be tied to that VM and removed when the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — it is created when the VM is provisioned and automatically deleted when the VM is deleted. This identity can be used to authenticate to Azure Key Vault without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens. This matches the requirement that the identity be removed when the VM is deleted.

Answer

A user-assigned managed identity

Answer

A storage account shared access signature

Answer

A local administrator account with a strong password

Question 7

A VM-hosted app must read blobs from Azure Storage without storing a shared key, SAS token, or password. Which two configuration steps should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Azure to automatically manage a service principal for the VM, eliminating the need for any stored credentials. By assigning the Storage Blob Data Reader role to that identity on the storage account, the VM can authenticate to Azure Storage using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint, without ever storing a shared key, SAS token, or password.

Answer

Store the storage account access key in the app configuration.

Answer

Generate a SAS token and embed it in the application code.

Answer

Move the VM into a different subnet.

Question 8

A partner company needs a developer to access resources in your tenant by using the developer's existing work account. You do not want to create a new separate username and password for that person. What should you create in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because Microsoft Entra ID B2B collaboration allows you to invite an external user's existing work account as a guest user. This grants access to resources without creating a new username and password, as the developer authenticates using their home tenant credentials. Guest users are managed in Entra ID and can be assigned permissions via Azure RBAC or group membership.

Answer

A local user account in each resource group

Answer

A managed identity

Answer

A new service principal

Question 9

Based on the exhibit, which identity approach should the administrator use so both VMs can share the same access without managing secrets or recreating role assignments when a VM is replaced?

Accepted Answer

A single user-assigned managed identity attached to both VMs.. A user-assigned managed identity is an independent Azure resource that can be attached to multiple VMs, allowing them to share the same identity for accessing Azure resources. This approach eliminates the need to manage secrets (like passwords or keys) and avoids recreating role assignments when a VM is replaced, because the identity persists independently of the VM lifecycle.

Answer

A separate system-assigned managed identity on each VM.

Answer

An administrator username and password stored in the script.

Answer

A shared access signature assigned to the virtual network.

Question 10

A company has 18 subscriptions under a management group named Corp. The audit team needs Reader access to all current and future subscriptions in Corp without creating one assignment per subscription. Which two statements are correct? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Option A is correct because Azure RBAC assignments made at a management group scope are inherited by all subscriptions, resource groups, and resources beneath that management group, so a single Reader assignment at the Corp management group grants Reader to all 18 current subscriptions. Option B is correct because inheritance only applies to resources within the management group hierarchy; any new subscription must be placed under the Corp management group to automatically inherit the Reader assignment, which satisfies the 'future subscriptions' requirement without per-subscription assignments. Option C is incorrect because assigning Reader at each subscription scope requires one assignment per subscription, which the scenario explicitly wants to avoid. Option D is incorrect because a resource group scope only covers resources in that group, not the whole subscription, and would still require many assignments. Option E is incorrect because a lock (CanNotDelete or ReadOnly) is a governance control that restricts operations and does not grant Reader RBAC permissions to the audit team.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader at one resource group in each subscription.

Answer

Create a lock on each subscription to provide Reader access.

Question 11

A subscription must block creation of resources in any region except East US and West US, and the security team also wants a nonblocking report of existing resources that are missing a CostCenter tag. Which two Azure Policy effects should you use? Select two.

Accepted Answer

Deny. Deny is correct because it actively blocks resource creation in regions outside East US and West US by evaluating the location property against an allowed list and rejecting non-compliant requests at deployment time. Audit is correct because it logs a compliance event for existing resources missing the CostCenter tag without blocking any operations, providing a nonblocking report for the security team.

Answer

Modify

Answer

DeployIfNotExists

Answer

Disabled

Question 12

The service desk needs to add and remove users from a support group that grants access to an internal application, but the service desk must not receive Azure subscription permissions. Which two actions should you take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the application access.. Creating a security group in Microsoft Entra ID (formerly Azure AD) allows you to manage access to the internal application without granting any Azure subscription permissions. The service desk can then add or remove users from this group, and the application's access control can be configured to rely on group membership, ensuring the service desk staff never receive Azure RBAC roles.

Answer

Assign the service desk staff Contributor on the subscription.

Answer

Convert the service desk staff into guest users in the tenant.

Answer

Add the service desk staff as members only, without ownership.

Question 13

Based on the exhibit, which identity should be enabled on the VM so the application can access Azure Blob Storage and the identity disappears when the VM is deleted?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It can be granted access to Azure Blob Storage via Azure RBAC, allowing the application to authenticate without storing credentials. This matches the requirement for an identity that disappears with the VM.

Answer

User-assigned managed identity

Answer

Storage account shared key

Answer

SAS token stored in a startup script

Question 14

A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.

Answer

Audit

Answer

Append

Answer

Disabled

Question 15

A department wants three related policies grouped together and assigned as one unit to a set of subscriptions. Which two statements about an Azure Policy initiative are correct? Select two.

Accepted Answer

An initiative groups multiple policy definitions into one assignment.. Option A is correct because an Azure Policy initiative (also called a policy set) is specifically designed to bundle multiple related policy definitions together so they can be managed and assigned as a single unit, which matches the department's goal of grouping three related policies. Option B is correct because initiatives, like individual policies, can be assigned at management group scope, and assignments at that scope are inherited by all child subscriptions, which satisfies the requirement to apply the grouped policies to a set of subscriptions. Option C is incorrect because granting Azure permissions is the role of Azure RBAC role assignments, not Azure Policy initiatives. Option D is incorrect because resource locks are a separate Azure feature managed via Microsoft.Authorization/locks, and initiatives do not replace them. Option E is incorrect because creating resource groups is done through the Azure portal, CLI, PowerShell, ARM/Bicep templates, or Terraform, not through a policy initiative.

Answer

An initiative grants Azure permissions to users.

Answer

An initiative replaces resource group locks.

Answer

An initiative is used to create a new resource group.