AZ-104 Manage Azure Identities and Governance Practice Test 13 — 15 Questions

Question 1

Three VMs run the same batch app and should use the same Azure identity to read blobs. The identity should remain available even if one VM is deleted. Which identity should you use?

Accepted Answer

User-assigned managed identity. C is correct because a user-assigned managed identity is an independent Azure resource that persists even if a specific VM is deleted. This allows multiple VMs to share the same identity to authenticate to Azure Blob Storage, ensuring continuous access to blobs as long as at least one VM remains.

Answer

Shared access signature (SAS) token

Answer

System-assigned managed identity

Answer

Storage account shared key

Question 2

Three Azure VMs in separate resource groups run the same data-processing agent. The agent must read blobs from a storage account, and the access must continue to work if any VM is rebuilt or replaced. The operations team also wants one identity they can reassign to future VMs without creating another credential. Which identity approach should be used?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity (D) is the correct choice because it is a standalone Azure resource that can be created independently and then attached to multiple VMs. If a VM is rebuilt or replaced, the same user-assigned identity can be reassigned to the new VM without any credential rotation or secret management. This ensures continuous blob access via Microsoft Entra ID authentication, meeting the requirement for a single, reusable identity.

Answer

A system-assigned managed identity on each VM.

Answer

A storage account shared key embedded in the application settings.

Answer

A service principal credential stored in a Key Vault secret.

Question 3

Based on the exhibit, which Azure Policy construct should the administrator use to deploy and manage these guardrails as one unit across the department?

Accepted Answer

Create an Azure Policy initiative and assign it at the management group scope.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for deployment as a single unit. By assigning the initiative at the management group scope, the administrator can enforce consistent guardrails across all subscriptions within that management group, ensuring centralized governance and compliance for the entire department.

Answer

Create an Azure RBAC role assignment at the management group scope.

Answer

Apply a ReadOnly lock to each subscription.

Answer

Move all resources into one resource group.

Question 4

Based on the exhibit, where should the Reader role be assigned so the audit team automatically has access to every current and future subscription under Corp?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope uses Azure RBAC inheritance to grant the audit team read-only access to all current and future subscriptions under that management group. Because management group scope propagates role assignments to all child subscriptions and resource groups, this ensures automatic coverage without manual updates.

Answer

Assign Reader at the subscription scope for Sub-001.

Answer

Assign Reader at the resource group scope in each subscription.

Answer

Assign Reader directly to each resource that the audit team might review.

Question 5

An operations team must enforce two rules across all subscriptions in a department: new resources must include a CostCenter tag, and deployments are allowed only in East US and West US. The team wants one assignment and automatic blocking of noncompliant deployments. Which three actions should the administrator take? Select three.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. An Azure Policy initiative (a set of policy definitions) allows combining the CostCenter tag requirement and the allowed region restriction into a single assignment, simplifying management. This ensures both rules are enforced together across all subscriptions in the department.

Answer

Grant Contributor at the subscription scope.

Answer

Apply a CanNotDelete lock to each resource group.

Question 6

A company wants to stop users from creating resources in any Azure region except East US and West US across all subscriptions. Which Azure feature should be used to enforce this requirement?

Accepted Answer

An Azure Policy assignment with a Deny effect at the management group scope. Azure Policy with a Deny effect at the management group scope is the correct choice because it can enforce a location constraint across all subscriptions under that management group. The Deny effect prevents the creation of resources in non-compliant regions at the time of deployment, ensuring that only East US and West US are allowed. This is a governance control that applies to all subscriptions within the scope, making it the ideal solution for this requirement.

Answer

An Azure RBAC role assignment

Answer

A CanNotDelete resource lock on the subscriptions

Answer

A tag inheritance rule on the management group

Question 7

A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity (B) is the correct choice because it allows the VM to authenticate to Azure Storage without storing any credentials in code or configuration. Azure automatically manages the identity's lifecycle and provides a token that the VM can use to access the storage account via Microsoft Entra ID authentication, eliminating the need for secrets.

Answer

A storage account access key

Answer

A shared access signature (SAS) token

Answer

A local administrator account on the VM

Question 8

A project team expects frequent joiners and leavers. The same Azure permissions are needed for all members of the team, and you want to avoid editing role assignments for each person. Which two actions best meet the requirement? Select two.

Accepted Answer

Create a security group for the project team.. Creating a security group allows you to manage permissions collectively rather than individually. By adding or removing users from the group as joiners and leavers occur, you avoid editing role assignments for each person. This aligns with Microsoft Entra ID group-based licensing and RBAC best practices for dynamic teams.

Answer

Assign the same roles directly to every user account.

Answer

Use guest accounts for all team members.

Answer

Assign the roles to a service principal shared by the team.

Question 9

A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. Azure Policy Initiative allows grouping multiple policy definitions (like audit for missing tags and deny for unapproved locations) into a single set for coordinated enforcement. Assigning the initiative at the management group scope ensures it applies to all current and future subscriptions under that management group, meeting the requirement for consistent governance across all 10 subscriptions and any new ones added later.

Answer

Assign each policy only to one resource group.

Answer

Use Azure RBAC instead of Policy for both requirements.

Answer

Create a read-only lock on each subscription.

Question 10

A central audit team needs Reader access on every current and future subscription under the company hierarchy. Which scope should you use for the role assignment?

Accepted Answer

Management group scope. A management group scope allows role assignments to be inherited by all subscriptions and resource groups within that management group hierarchy. By assigning the Reader role at the management group level, the central audit team automatically gains read access to every current subscription and any future subscription added under that management group, ensuring consistent governance without manual updates.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 11

You want to group subscriptions for Finance, HR, and Engineering so you can apply governance consistently at a higher level. What should you create?

Accepted Answer

Management groups. Management groups are the correct choice because they allow you to organize Azure subscriptions into a hierarchy for applying governance policies, role-based access control (RBAC), and cost management consistently across multiple subscriptions. By creating a management group hierarchy (e.g., Finance, HR, Engineering), you can assign Azure Policy initiatives or RBAC roles at the management group level, which are inherited by all subscriptions within that group. This provides a scalable and centralized governance model without needing to configure each subscription individually.

Answer

Resource groups

Answer

Tags

Answer

Resource locks

Question 12

Finance wants every resource created in one production resource group to receive the tag CostCenter=FINSVC automatically, but deployments should not be blocked if a template omits the tag. Existing resources should be updated when possible. Which two actions should the administrator take? Select two.

Accepted Answer

Assign a Modify policy that adds or updates the CostCenter tag.. Option A is correct because an Azure Policy with the Modify effect can automatically add or update the CostCenter=FINSVC tag on resources created in the production resource group, and its remediation capability allows existing resources to be brought into compliance without blocking deployments. Option B is correct because after assigning a Modify policy, a remediation task is required to apply the tag to existing noncompliant resources, satisfying the requirement to update existing resources when possible. Option C is incorrect because a ReadOnly lock prevents modifications, including tag updates, and does not enforce tagging. Option D is incorrect because Reader only grants read access and has no effect on tag creation or enforcement. Option E is incorrect because an Audit policy only reports noncompliance and does not automatically add the tag or update existing resources.

Answer

Apply a ReadOnly lock to the resource group to keep tags consistent.

Answer

Assign Reader to the resource group to ensure tag visibility.

Answer

Use only an Audit policy so teams can see missing tags.

Question 13

A production resource group contains several VMs and a storage account. The operations manager wants to prevent accidental deletion of the resource group and its resources, but still allow normal configuration changes during maintenance windows. Which lock should be applied to the resource group?

Accepted Answer

CanNotDelete lock at the resource group scope.. A CanNotDelete lock at the resource group scope prevents the deletion of the resource group and all its resources, while still allowing configuration changes (e.g., modifying VM settings or updating storage account properties). This meets the operations manager's requirement to block accidental deletion but permit normal maintenance operations. ReadOnly locks would block all write operations, which is too restrictive for maintenance windows.

Answer

ReadOnly lock at the resource group scope.

Answer

Azure Policy assignment that denies all delete requests.

Answer

Apply the lock only to individual virtual machines.

Question 14

Based on the exhibit, three VMs in different resource groups must use the same Azure identity, and the identity must continue working if one VM is deleted and recreated. What should you use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is an Azure resource that can be created independently and then assigned to multiple VMs. Because it persists as a separate resource in Azure, deleting and recreating a VM does not affect the identity; you simply reattach the same user-assigned identity to the new VM. This ensures the identity continues working across VM lifecycle changes, meeting the requirement for a shared, resilient identity.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal stored in the VM image.

Answer

A shared access signature assigned to the resource group.

Question 15

Based on the exhibit, what is the best way to simplify access management for the project team?

Accepted Answer

Assign the RBAC role to an Entra ID group and manage membership there.. Assigning the RBAC role to an Entra ID group and managing membership centrally is the recommended approach because it decouples role assignments from individual user accounts. When team membership changes, you only update group membership rather than reassigning roles per user. This reduces administrative overhead and the risk of orphaned or excessive permissions, and it aligns with Azure's least-privilege and identity-governance best practices.

Answer

Keep assigning RBAC roles directly to each user account.

Answer

Create a resource lock on RG-App.

Answer

Create an Azure Policy assignment for RG-App.