AZ-104 Manage Azure Identities and Governance Practice Test 14 — 15 Questions

Question 1

A policy initiative is assigned at the Corp management group to enforce allowed locations and required tags. A new subscription is added under Corp later. Which two statements are true? Select two.

Accepted Answer

The new subscription is automatically in scope because the assignment is at the management group.. Option A is correct because Azure Policy assignments at a management group scope are inherited by all child subscriptions, including new ones added later. When the Corp management group has the initiative assigned, any subscription under Corp automatically falls within the policy's evaluation scope without requiring manual re-assignment.

Answer

The initiative must be copied to every resource group in the new subscription before it takes effect.

Answer

The initiative changes RBAC so users lose read access to the subscription.

Answer

Compliance results are only visible in Activity Log, not in Azure Policy.

Question 2

A management group named Corp contains subscription Sales. RG-App is in Sales and contains several virtual machines. The Auditors group must read every resource in Sales, including resources in future resource groups created under that subscription. The ServerOps group must be able to start, stop, and restart only the virtual machines in RG-App. Which two role assignments should the administrator configure? Select two.

Accepted Answer

Assign Reader to Auditors at the Sales subscription scope.. Option A is correct because assigning the Reader role to the Auditors group at the Sales subscription scope grants read access to all resources within that subscription, including any future resource groups and resources created under it. This meets the requirement that Auditors must read every resource in Sales, including those in future resource groups.

Answer

Assign Reader to Auditors at the RG-App resource group scope.

Answer

Assign Virtual Machine Contributor to ServerOps at the Sales subscription scope.

Answer

Assign Owner to ServerOps at the RG-App resource group scope.

Question 3

Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.

Accepted Answer

Create a user-assigned managed identity that can exist independently of any single VM.. A user-assigned managed identity is an Azure resource that exists independently of any VM, unlike a system-assigned identity which is tied to the VM lifecycle. This independence ensures the identity persists even when a VM is deleted and recreated, maintaining continuous access to the configuration endpoint. By creating a user-assigned managed identity, the administrator decouples the identity from any single VM, satisfying the requirement that the identity must keep working after VM deletion and recreation.

Answer

Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

Answer

Store one application password locally on each VM and use it instead of Azure-managed identities.

Question 4

Based on the exhibit, the help desk team must be able to restart virtual machines in RG-App, but they must not be able to create, delete, or resize VMs. What is the best action?

Accepted Answer

Create a custom RBAC role that allows VM start, restart, and deallocate actions, then assign it at RG-App.. Option C is correct because the help desk team needs only specific actions (start, restart, deallocate) without the ability to create, delete, or resize VMs. The built-in Virtual Machine Contributor role includes write permissions that allow creating and deleting VMs, so a custom RBAC role that explicitly grants only the required actions (Microsoft.Compute/virtualMachines/start/action, restart/action, deallocate/action) and is assigned at the RG-App scope meets the requirement precisely.

Answer

Assign Virtual Machine Contributor to HelpDeskGroup at the subscription scope.

Answer

Assign Contributor to HelpDeskGroup at RG-App.

Answer

Assign Owner to HelpDeskGroup at RG-App and use Azure Policy to block unwanted changes.

Question 5

An operations team must be able to restart virtual machines in one resource group. They must not create, delete, resize, or change disks or networking. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role that includes only read and restart actions for virtual machines.. Option A is correct because a custom RBAC role can be defined to include only the 'Microsoft.Compute/virtualMachines/read' and 'Microsoft.Compute/virtualMachines/restart/action' permissions, which precisely limits the operations team to reading and restarting VMs without allowing create, delete, resize, or disk/network changes. This aligns with the principle of least privilege.

Answer

Assign the Virtual Machine Contributor role to the operations group.

Answer

Create an Azure Policy assignment that denies VM creation in the resource group.

Answer

Apply a ReadOnly lock to the resource group.

Question 6

Based on the exhibit, the production resource group must not be deleted during a change freeze, but administrators still need to update VM sizes and tag values. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. A CanNotDelete lock (B) prevents deletion of the resource group while allowing all other operations, including updating VM sizes and modifying tag values. This meets the requirement of blocking deletion during a change freeze without restricting administrative updates.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a lock to the subscription instead of the resource group.

Answer

Use Azure Policy with a deny effect to block deletes.

Question 7

During a change freeze, an administrator applies a lock to a resource group. Users can still read resource details, but attempts to update tags, resize a VM, or change an NSG fail. Which lock was applied?

Accepted Answer

ReadOnly lock, because it blocks write operations while allowing read access.. The ReadOnly lock (option B) is correct because it explicitly blocks all write operations (including updates to tags, resizing a VM, or modifying an NSG) while allowing read operations. This matches the scenario where users can still read resource details but cannot perform any modifications.

Answer

CanNotDelete lock, because it blocks all updates but allows reading.

Answer

Reader role assignment, because it removes edit permissions from the group.

Answer

Azure Policy audit assignment, because it reports changes without blocking them.

Question 8

A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.

Accepted Answer

Create a policy initiative that groups the governance requirements.. Option A is correct because a policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.

Answer

Assign the policies separately to each existing subscription only.

Answer

Use an RBAC Contributor role to enforce region and tag compliance.

Question 9

The finance team wants every resource created in one resource group to carry the same CostCenter tag automatically. They want to reduce manual entry and keep the tag value consistent. What should you configure?

Accepted Answer

Use Azure Policy to inherit the CostCenter tag from the resource group. Option D is correct because Azure Policy can enforce tag inheritance from a resource group to all resources within it using the 'Inherit a tag from the resource group' built-in policy effect. This ensures the CostCenter tag is automatically applied to every new or existing resource without manual entry, maintaining consistency and reducing administrative overhead.

Answer

Ask users to add the tag manually to every resource

Answer

Assign a Reader role to the finance team

Answer

Apply a CanNotDelete lock to the resource group

Question 10

A contractor should be able to view resources in one resource group for 30 days. When the contract ends, removing the contractor from the group should immediately remove access. What is the best approach?

Accepted Answer

Assign Reader to an Entra ID group and add the contractor to that group.. Assigning the Reader role to an Entra ID group and adding the contractor as a member allows centralized access management. When the contractor is removed from the group, the role assignment is immediately revoked because Azure RBAC evaluates group membership at the time of authorization. This meets the 30-day requirement and ensures instant access removal upon contract termination.

Answer

Assign Reader directly to the contractor's user account at the resource group scope.

Answer

Assign Reader at the subscription scope to the contractor so access is simple.

Answer

Create a CanNotDelete lock on the resource group until the contract ends.

Question 11

Based on the exhibit, every resource created in RG-Finance must automatically receive CostCenter=FIN, but deployments should not fail if the tag is omitted. What should you configure?

Accepted Answer

Assign an Azure Policy with the Modify effect at RG-Finance.. Option A is correct because the Azure Policy 'Modify' effect can automatically add the CostCenter=FIN tag to resources in RG-Finance without causing deployment failures if the tag is omitted. Unlike 'Deny', which blocks non-compliant deployments, 'Modify' uses a remediation task to append the missing tag after creation, ensuring compliance without disruption.

Answer

Assign an RBAC role that forces all users to enter the tag.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Use Azure Policy with a Deny effect at the management group.

Question 12

RG-Prod is locked during a change freeze with a CanNotDelete lock. Administrators still need to keep the environment healthy without removing the lock. Which three actions can still be completed? Select three.

Accepted Answer

Change the size of an existing virtual machine in the resource group.. A CanNotDelete lock prevents deletion of resources but allows all management operations that do not involve deletion. Changing the size of an existing virtual machine is a modification operation, not a deletion, so it is permitted under this lock type.

Answer

Delete an unused storage account from the resource group.

Answer

Delete the entire resource group to rebuild it from scratch.

Question 13

An administrator assigned a modify policy at the subscription scope to add a CostCenter tag to new virtual machines. New VMs now have the tag, but older VMs in the subscription still do not. What must the administrator do to bring the existing VMs into compliance?

Accepted Answer

Create a remediation task for the noncompliant resources.. The modify effect policy assigned at the subscription scope automatically applies the CostCenter tag to new resources during creation, but it does not retroactively update existing noncompliant resources. To bring older VMs into compliance, the administrator must create a remediation task, which triggers Azure Policy's deployment engine to evaluate and apply the defined modify effect (e.g., adding the missing tag) to existing noncompliant resources using a managed identity.

Answer

Reassign the policy at the resource group scope.

Answer

Add a resource lock to the subscription.

Answer

Move the VMs to another resource group and back again.

Question 14

A Modify policy adds CostCenter=042 to resources in RG-Finance. New resources are tagged correctly, but existing virtual machines remain untagged. What three requirements must be met for the assignment to update the existing resources? Select three.

Accepted Answer

Create a remediation task for the policy assignment.. Option A is correct because a remediation task is required to apply a Modify effect policy to existing non-compliant resources. The Modify effect only tags new resources automatically; existing resources remain untagged until a remediation task is triggered, which uses the policy's managed identity to update the resource tags.

Answer

Recreate the virtual machines before the policy can evaluate them.

Answer

Change the effect from Modify to Audit to trigger the tag operation.

Question 15

A support team must be able to start, stop, and restart virtual machines in one application resource group, but they must not create or delete VMs, modify disks, or manage networking. What is the best access approach?

Accepted Answer

Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.. Option B is correct because Azure RBAC allows you to create a custom role with specific actions like Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/restart/action, and Microsoft.Compute/virtualMachines/deallocate/action, and assign it at the resource group scope. This grants the support team exactly the permissions needed to start, stop, and restart VMs without allowing VM creation, deletion, disk modification, or networking changes, adhering to the principle of least privilege.

Answer

Assign Contributor at the subscription scope so the team can manage all resources.

Answer

Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.

Answer

Apply a resource lock to the resource group so the team can only make approved changes.