AZ-104 Manage Azure Identities and Governance Practice Test 12 — 15 Questions

Question 1

A central audit group must have Reader access for every current and future subscription in the company hierarchy. You want one assignment that will apply broadly as new subscriptions are added. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions. Assigning the Reader role at the management group level ensures that the central audit group inherits the role to all current and future subscriptions within that management group hierarchy. This is the most efficient and scalable approach because Azure RBAC assignments on a management group are inherited by all child subscriptions and resource groups, eliminating the need to manually update permissions as new subscriptions are added.

Answer

At one resource group in each subscription

Answer

At a single resource

Answer

At the tenant root only for one application

Question 2

A department wants three related policies grouped together and assigned as one unit to a set of subscriptions. Which two statements about an Azure Policy initiative are correct? Select two.

Accepted Answer

An initiative groups multiple policy definitions into one assignment.. Option A is correct because an Azure Policy initiative is specifically designed to group multiple policy definitions into a single assignment. This allows you to apply a set of related compliance rules as one unit, simplifying management and ensuring consistent enforcement across subscriptions.

Answer

An initiative grants Azure permissions to users.

Answer

An initiative replaces resource group locks.

Answer

An initiative is used to create a new resource group.

Question 3

Three VMs run the same batch app and should use the same Azure identity to read blobs. The identity should remain available even if one VM is deleted. Which identity should you use?

Accepted Answer

User-assigned managed identity. C is correct because a user-assigned managed identity is an independent Azure resource that persists even if a specific VM is deleted. This allows multiple VMs to share the same identity to authenticate to Azure Blob Storage, ensuring continuous access to blobs as long as at least one VM remains.

Answer

Shared access signature (SAS) token

Answer

System-assigned managed identity

Answer

Storage account shared key

Question 4

Based on the exhibit, which lock should the administrator apply to protect the resource group from accidental deletion while still allowing normal updates to the resources inside it?

Accepted Answer

Apply a CanNotDelete lock to rg-payroll-prod.. The CanNotDelete lock (also known as Delete lock) prevents the resource group itself from being deleted while still allowing all updates (including create, modify, and delete operations) on the resources within it. This is the correct choice because the requirement is to protect only the resource group from accidental deletion, not to restrict changes to the resources inside.

Answer

Apply a ReadOnly lock to rg-payroll-prod.

Answer

Apply a tag named Protected=True to rg-payroll-prod.

Answer

Create an Azure Policy assignment that denies all delete operations.

Question 5

Three Azure VMs in separate resource groups run the same data-processing agent. The agent must read blobs from a storage account, and the access must continue to work if any VM is rebuilt or replaced. The operations team also wants one identity they can reassign to future VMs without creating another credential. Which identity approach should be used?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity (D) is the correct choice because it is a standalone Azure resource that can be created independently and then attached to multiple VMs. If a VM is rebuilt or replaced, the same user-assigned identity can be reassigned to the new VM without any credential rotation or secret management. This ensures continuous blob access via Azure AD authentication, meeting the requirement for a single, reusable identity.

Answer

A system-assigned managed identity on each VM.

Answer

A storage account shared key embedded in the application settings.

Answer

A service principal credential stored in a Key Vault secret.

Question 6

Based on the exhibit, which Azure Policy construct should the administrator use to deploy and manage these guardrails as one unit across the department?

Accepted Answer

Create an Azure Policy initiative and assign it at the management group scope.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for deployment as a single unit. By assigning the initiative at the management group scope, the administrator can enforce consistent guardrails across all subscriptions within that management group, ensuring centralized governance and compliance for the entire department.

Answer

Create an Azure RBAC role assignment at the management group scope.

Answer

Apply a ReadOnly lock to each subscription.

Answer

Move all resources into one resource group.

Question 7

Based on the exhibit, where should the Reader role be assigned so the audit team automatically has access to every current and future subscription under Corp?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope uses Azure RBAC inheritance to grant the audit team read-only access to all current and future subscriptions under that management group. Because management group scope propagates role assignments to all child subscriptions and resource groups, this ensures automatic coverage without manual updates.

Answer

Assign Reader at the subscription scope for Sub-001.

Answer

Assign Reader at the resource group scope in each subscription.

Answer

Assign Reader directly to each resource that the audit team might review.

Question 8

An operations team must enforce two rules across all subscriptions in a department: new resources must include a CostCenter tag, and deployments are allowed only in East US and West US. The team wants one assignment and automatic blocking of noncompliant deployments. Which three actions should the administrator take? Select three.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. Option A is correct because an Azure Policy initiative (a set of policy definitions) allows combining the CostCenter tag requirement and the allowed region restriction into a single assignment, simplifying management. This ensures both rules are enforced together across all subscriptions in the department.

Answer

Grant Contributor at the subscription scope.

Answer

Apply a CanNotDelete lock to each resource group.

Question 9

A company wants to stop users from creating resources in any Azure region except East US and West US across all subscriptions. Which Azure feature should be used to enforce this requirement?

Accepted Answer

An Azure Policy assignment with a Deny effect at the management group scope. Azure Policy with a Deny effect at the management group scope is the correct choice because it can enforce a location constraint across all subscriptions under that management group. The Deny effect prevents the creation of resources in non-compliant regions at the time of deployment, ensuring that only East US and West US are allowed. This is a governance control that applies to all subscriptions within the scope, making it the ideal solution for this requirement.

Answer

An Azure RBAC role assignment

Answer

A CanNotDelete resource lock on the subscriptions

Answer

A tag inheritance rule on the management group

Question 10

A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity (B) is the correct choice because it allows the VM to authenticate to Azure Storage without storing any credentials in code or configuration. Azure automatically manages the identity's lifecycle and provides a token that the VM can use to access the storage account via Azure AD authentication, eliminating the need for secrets.

Answer

A storage account access key

Answer

A shared access signature (SAS) token

Answer

A local administrator account on the VM

Question 11

A project team expects frequent joiners and leavers. The same Azure permissions are needed for all members of the team, and you want to avoid editing role assignments for each person. Which two actions best meet the requirement? Select two.

Accepted Answer

Create a security group for the project team.. Option A is correct because creating a security group allows you to manage permissions collectively rather than individually. By adding or removing users from the group as joiners and leavers occur, you avoid editing role assignments for each person. This aligns with Azure AD group-based licensing and RBAC best practices for dynamic teams.

Answer

Assign the same roles directly to every user account.

Answer

Use guest accounts for all team members.

Answer

Assign the roles to a service principal shared by the team.

Question 12

A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. Azure Policy Initiative allows grouping multiple policy definitions (like audit for missing tags and deny for unapproved locations) into a single set for coordinated enforcement. Assigning the initiative at the management group scope ensures it applies to all current and future subscriptions under that management group, meeting the requirement for consistent governance across all 10 subscriptions and any new ones added later.

Answer

Assign each policy only to one resource group.

Answer

Use Azure RBAC instead of Policy for both requirements.

Answer

Create a read-only lock on each subscription.

Question 13

A central audit team needs Reader access on every current and future subscription under the company hierarchy. Which scope should you use for the role assignment?

Accepted Answer

Management group scope. A management group scope allows role assignments to be inherited by all subscriptions and resource groups within that management group hierarchy. By assigning the Reader role at the management group level, the central audit team automatically gains read access to every current subscription and any future subscription added under that management group, ensuring consistent governance without manual updates.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 14

You want to group subscriptions for Finance, HR, and Engineering so you can apply governance consistently at a higher level. What should you create?

Accepted Answer

Management groups. Management groups are the correct choice because they allow you to organize Azure subscriptions into a hierarchy for applying governance policies, role-based access control (RBAC), and cost management consistently across multiple subscriptions. By creating a management group hierarchy (e.g., Finance, HR, Engineering), you can assign Azure Policy initiatives or RBAC roles at the management group level, which are inherited by all subscriptions within that group. This provides a scalable and centralized governance model without needing to configure each subscription individually.

Answer

Resource groups

Answer