AZ-104 Manage Azure Identities and Governance Practice Test 14 — 15 Questions

Question 1

Based on the exhibit, the Prod management group contains three subscriptions that host application workloads. An operations group must be able to read all current and future resources in those Prod subscriptions, but it must not have access to Sandbox. Where should you assign the Reader role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign Reader to OpsGroup at the Prod management group.. Assigning the Reader role at the Prod management group scope ensures that OpsGroup inherits read permissions to all current and future subscriptions and resources within that management group, while excluding the Sandbox subscription which is outside the Prod hierarchy. This leverages Azure RBAC inheritance, where roles assigned at a management group propagate to all child subscriptions and resource groups, meeting the requirement for a single assignment that covers all Prod workloads without granting access to Sandbox.

Answer

Assign Reader to OpsGroup at the Corp management group.

Answer

Assign Reader to OpsGroup at one application resource group in AppSub1.

Answer

Assign Reader to OpsGroup at each subscription individually.

Question 2

A contractor needs read-only access to resources in one application resource group. The access must be removed immediately when the contractor is removed from the contractor team. What is the best access strategy?

Accepted Answer

Assign Reader to the Entra ID contractor group at the resource group scope.. Assigning the Reader role to the Entra ID contractor group at the resource group scope ensures that all members of the group inherit read-only access to resources within that specific resource group. When a contractor is removed from the Entra ID group, their access is immediately revoked because Azure RBAC evaluates group membership dynamically at authentication time. This approach follows the principle of least privilege and enables centralized access management via group-based assignments.

Answer

Assign Reader directly to the contractor's user account at the subscription scope.

Answer

Assign Contributor to the contractor group at the resource group scope.

Answer

Assign Reader to the contractor group at the management group scope.

Question 3

Based on the exhibit, a compliance team must read all current and future resources in every subscription under the Corp management group. Where should you assign the Reader role?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope applies the role to all current and future subscriptions and resource groups within that management group hierarchy. This is because Azure RBAC roles assigned at a management group scope are inherited by all child management groups, subscriptions, and resources, ensuring the compliance team can read all resources across the entire Corp hierarchy without needing separate assignments.

Answer

Assign Reader at the RG-Finance resource group scope.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader only at the individual resource scope.

Question 4

Based on the exhibit, the team must prevent accidental deletion of a resource group, but administrators still need to update settings on resources inside it. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. Applying a CanNotDelete lock to RG-Prod prevents the resource group from being deleted while still allowing administrators to update settings on resources inside it. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to prevent accidental deletion without restricting management changes.

Answer

Apply no lock and rely on RBAC alone.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a Contributor role assignment to RG-Prod.

Question 5

A policy initiative is assigned at the Corp management group to enforce allowed locations and required tags. A new subscription is added under Corp later. Which two statements are true? Select two.

Accepted Answer

The new subscription is automatically in scope because the assignment is at the management group.. Azure Policy assignments at a management group scope are inherited by all child subscriptions, including new ones added later. When the Corp management group has the initiative assigned, any subscription under Corp automatically falls within the policy's evaluation scope without requiring manual re-assignment.

Answer

The initiative must be copied to every resource group in the new subscription before it takes effect.

Answer

The initiative changes RBAC so users lose read access to the subscription.

Answer

Compliance results are only visible in Activity Log, not in Azure Policy.

Question 6

A management group named Corp contains subscription Sales. RG-App is in Sales and contains several virtual machines. The Auditors group must read every resource in Sales, including resources in future resource groups created under that subscription. The ServerOps group must be able to start, stop, and restart only the virtual machines in RG-App. Which two role assignments should the administrator configure? Select two.

Accepted Answer

Assign Reader to Auditors at the Sales subscription scope.. Assigning the Reader role to the Auditors group at the Sales subscription scope grants read access to all resources within that subscription, including any future resource groups and resources created under it. This meets the requirement that Auditors must read every resource in Sales, including those in future resource groups.

Answer

Assign Reader to Auditors at the RG-App resource group scope.

Answer

Assign Virtual Machine Contributor to ServerOps at the Sales subscription scope.

Answer

Assign Owner to ServerOps at the RG-App resource group scope.

Question 7

Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.

Accepted Answer

Create a user-assigned managed identity that can exist independently of any single VM.. A user-assigned managed identity is an Azure resource that exists independently of any VM, unlike a system-assigned identity which is tied to the VM lifecycle. This independence ensures the identity persists even when a VM is deleted and recreated, maintaining continuous access to the configuration endpoint. By creating a user-assigned managed identity, the administrator decouples the identity from any single VM, satisfying the requirement that the identity must keep working after VM deletion and recreation.

Answer

Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

Answer

Store one application password locally on each VM and use it instead of Azure-managed identities.

Question 8

Based on the exhibit, the help desk team must be able to restart virtual machines in RG-App, but they must not be able to create, delete, or resize VMs. What is the best action?

Accepted Answer

Create a custom RBAC role that allows VM start, restart, and deallocate actions, then assign it at RG-App.. The help desk team needs only specific actions (start, restart, deallocate) without the ability to create, delete, or resize VMs. The built-in Virtual Machine Contributor role includes write permissions that allow creating and deleting VMs, so a custom RBAC role that explicitly grants only the required actions (Microsoft.Compute/virtualMachines/start/action, restart/action, deallocate/action) and is assigned at the RG-App scope meets the requirement precisely.

Answer

Assign Virtual Machine Contributor to HelpDeskGroup at the subscription scope.

Answer

Assign Contributor to HelpDeskGroup at RG-App.

Answer

Assign Owner to HelpDeskGroup at RG-App and use Azure Policy to block unwanted changes.

Question 9

An operations team must be able to restart virtual machines in one resource group. They must not create, delete, resize, or change disks or networking. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role that includes only read and restart actions for virtual machines.. A custom RBAC role can be defined to include only the 'Microsoft.Compute/virtualMachines/read' and 'Microsoft.Compute/virtualMachines/restart/action' permissions, which precisely limits the operations team to reading and restarting VMs without allowing create, delete, resize, or disk/network changes. This aligns with the principle of least privilege.

Answer

Assign the Virtual Machine Contributor role to the operations group.

Answer

Create an Azure Policy assignment that denies VM creation in the resource group.

Answer

Apply a ReadOnly lock to the resource group.

Question 10

Based on the exhibit, the production resource group must not be deleted during a change freeze, but administrators still need to update VM sizes and tag values. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. A CanNotDelete lock (B) prevents deletion of the resource group while allowing all other operations, including updating VM sizes and modifying tag values. This meets the requirement of blocking deletion during a change freeze without restricting administrative updates.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a lock to the subscription instead of the resource group.

Answer

Use Azure Policy with a deny effect to block deletes.

Question 11

During a change freeze, an administrator applies a lock to a resource group. Users can still read resource details, but attempts to update tags, resize a VM, or change an NSG fail. Which lock was applied?

Accepted Answer

ReadOnly lock, because it blocks write operations while allowing read access.. The ReadOnly lock (option B) is correct because it explicitly blocks all write operations (including updates to tags, resizing a VM, or modifying an NSG) while allowing read operations. This matches the scenario where users can still read resource details but cannot perform any modifications.

Answer

CanNotDelete lock, because it blocks all updates but allows reading.

Answer

Reader role assignment, because it removes edit permissions from the group.

Answer

Azure Policy audit assignment, because it reports changes without blocking them.

Question 12

A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.

Accepted Answer

Create a policy initiative that groups the governance requirements.. A policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.

Answer

Assign the policies separately to each existing subscription only.

Answer

Use an RBAC Contributor role to enforce region and tag compliance.

Question 13

The finance team wants every resource created in one resource group to carry the same CostCenter tag automatically. They want to reduce manual entry and keep the tag value consistent. What should you configure?

Accepted Answer

Use Azure Policy to inherit the CostCenter tag from the resource group. Azure Policy can enforce tag inheritance from a resource group to all resources within it using the 'Inherit a tag from the resource group' built-in policy effect. This ensures the CostCenter tag is automatically applied to every new or existing resource without manual entry, maintaining consistency and reducing administrative overhead.

Answer

Ask users to add the tag manually to every resource

Answer

Assign a Reader role to the finance team

Answer

Apply a CanNotDelete lock to the resource group

Question 14

A contractor should be able to view resources in one resource group for 30 days. When the contract ends, removing the contractor from the group should immediately remove access. What is the best approach?

Accepted Answer

Assign Reader to an Entra ID group and add the contractor to that group.. Assigning the Reader role to an Entra ID group and adding the contractor as a member allows centralized access management. When the contractor is removed from the group, the role assignment is immediately revoked because Azure RBAC evaluates group membership at the time of authorization. This meets the 30-day requirement and ensures instant access removal upon contract termination.

Answer

Assign Reader directly to the contractor's user account at the resource group scope.

Answer

Assign Reader at the subscription scope to the contractor so access is simple.

Answer

Create a CanNotDelete lock on the resource group until the contract ends.

Question 15

Based on the exhibit, every resource created in RG-Finance must automatically receive CostCenter=FIN, but deployments should not fail if the tag is omitted. What should you configure?

Accepted Answer

Assign an Azure Policy with the Modify effect at RG-Finance.. The Azure Policy 'Modify' effect can automatically add the CostCenter=FIN tag to resources in RG-Finance without causing deployment failures if the tag is omitted. Unlike 'Deny', which blocks non-compliant deployments, 'Modify' uses a remediation task to append the missing tag after creation, ensuring compliance without disruption.

Answer

Assign an RBAC role that forces all users to enter the tag.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Use Azure Policy with a Deny effect at the management group.