AZ-104 Manage Azure Identities and Governance Practice Test 15 — 15 Questions

Question 1

During a change freeze, an administrator applies a lock to a resource group. Users can still read resource details, but attempts to update tags, resize a VM, or change an NSG fail. Which lock was applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ReadOnly lock, because it blocks write operations while allowing read access.. The ReadOnly lock (option B) is correct because it explicitly blocks all write operations (including updates to tags, resizing a VM, or modifying an NSG) while allowing read operations. This matches the scenario where users can still read resource details but cannot perform any modifications.

Answer

CanNotDelete lock, because it blocks all updates but allows reading.

Answer

Reader role assignment, because it removes edit permissions from the group.

Answer

Azure Policy audit assignment, because it reports changes without blocking them.

Question 2

A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.

Accepted Answer

Create a policy initiative that groups the governance requirements.. A policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.

Answer

Assign the policies separately to each existing subscription only.

Answer

Use an RBAC Contributor role to enforce region and tag compliance.

Question 3

The finance team wants every resource created in one resource group to carry the same CostCenter tag automatically. They want to reduce manual entry and keep the tag value consistent. What should you configure?

Accepted Answer

Use Azure Policy to inherit the CostCenter tag from the resource group. Azure Policy can enforce tag inheritance from a resource group to all resources within it using the 'Inherit a tag from the resource group' built-in policy effect. This ensures the CostCenter tag is automatically applied to every new or existing resource without manual entry, maintaining consistency and reducing administrative overhead.

Answer

Ask users to add the tag manually to every resource

Answer

Assign a Reader role to the finance team

Answer

Apply a CanNotDelete lock to the resource group

Question 4

A contractor should be able to view resources in one resource group for 30 days. When the contract ends, removing the contractor from the group should immediately remove access. What is the best approach?

Accepted Answer

Assign Reader to an Entra ID group and add the contractor to that group.. Assigning the Reader role to an Entra ID group and adding the contractor as a member allows centralized access management. When the contractor is removed from the group, the role assignment is immediately revoked because Azure RBAC evaluates group membership at the time of authorization. This meets the 30-day requirement and ensures instant access removal upon contract termination.

Answer

Assign Reader directly to the contractor's user account at the resource group scope.

Answer

Assign Reader at the subscription scope to the contractor so access is simple.

Answer

Create a CanNotDelete lock on the resource group until the contract ends.

Question 5

Based on the exhibit, every resource created in RG-Finance must automatically receive CostCenter=FIN, but deployments should not fail if the tag is omitted. What should you configure?

Accepted Answer

Assign an Azure Policy with the Modify effect at RG-Finance.. The Azure Policy 'Modify' effect can automatically add the CostCenter=FIN tag to resources in RG-Finance without causing deployment failures if the tag is omitted. Unlike 'Deny', which blocks non-compliant deployments, 'Modify' uses a remediation task to append the missing tag after creation, ensuring compliance without disruption.

Answer

Assign an RBAC role that forces all users to enter the tag.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Use Azure Policy with a Deny effect at the management group.

Question 6

RG-Prod is locked during a change freeze with a CanNotDelete lock. Administrators still need to keep the environment healthy without removing the lock. Which three actions can still be completed? Select three.

Accepted Answer

Change the size of an existing virtual machine in the resource group.. A CanNotDelete lock prevents deletion of resources but allows all management operations that do not involve deletion. Changing the size of an existing virtual machine is a modification operation, not a deletion, so it is permitted under this lock type.

Answer

Delete an unused storage account from the resource group.

Answer

Delete the entire resource group to rebuild it from scratch.

Question 7

An administrator assigned a modify policy at the subscription scope to add a CostCenter tag to new virtual machines. New VMs now have the tag, but older VMs in the subscription still do not. What must the administrator do to bring the existing VMs into compliance?

Accepted Answer

Create a remediation task for the noncompliant resources.. The modify effect policy assigned at the subscription scope automatically applies the CostCenter tag to new resources during creation, but it does not retroactively update existing noncompliant resources. To bring older VMs into compliance, the administrator must create a remediation task, which triggers Azure Policy's deployment engine to evaluate and apply the defined modify effect (e.g., adding the missing tag) to existing noncompliant resources using a managed identity.

Answer

Reassign the policy at the resource group scope.

Answer

Add a resource lock to the subscription.

Answer

Move the VMs to another resource group and back again.

Question 8

A Modify policy adds CostCenter=042 to resources in RG-Finance. New resources are tagged correctly, but existing virtual machines remain untagged. What three requirements must be met for the assignment to update the existing resources? Select three.

Accepted Answer

Create a remediation task for the policy assignment.. A remediation task is required to apply a Modify effect policy to existing non-compliant resources. The Modify effect only tags new resources automatically; existing resources remain untagged until a remediation task is triggered, which uses the policy's managed identity to update the resource tags.

Answer

Recreate the virtual machines before the policy can evaluate them.

Answer

Change the effect from Modify to Audit to trigger the tag operation.

Question 9

A support team must be able to start, stop, and restart virtual machines in one application resource group, but they must not create or delete VMs, modify disks, or manage networking. What is the best access approach?

Accepted Answer

Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.. Azure RBAC allows you to create a custom role with specific actions like Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/restart/action, and Microsoft.Compute/virtualMachines/deallocate/action, and assign it at the resource group scope. This grants the support team exactly the permissions needed to start, stop, and restart VMs without allowing VM creation, deletion, disk modification, or networking changes, adhering to the principle of least privilege.

Answer

Assign Contributor at the subscription scope so the team can manage all resources.

Answer

Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.

Answer

Apply a resource lock to the resource group so the team can only make approved changes.

Question 10

Based on the exhibit, an administrator wants to prevent new Azure resources from being deployed in any region except East US and West US across the entire Corp hierarchy. What should the administrator configure?

Accepted Answer

Create and assign an Azure Policy at the Corp management group using the allowed locations rule.. Azure Policy is the correct tool to enforce governance rules across management groups. The 'allowed locations' built-in policy definition restricts resource deployment to specified regions. By assigning this policy at the Corp management group, the rule applies to all child subscriptions and resources, preventing deployment in any region except East US and West US.

Answer

Assign a built-in RBAC role that denies deployments in unsupported regions.

Answer

Apply a CanNotDelete lock to the subscriptions.

Answer

Use a resource tag named RegionApproved and require teams to set it manually.

Question 11

Based on the exhibit, a support lead must manage role assignments for RG-Apps so the team can grant or revoke access for others. The support lead must not be able to change resource configurations. Which role should you assign?

Accepted Answer

User Access Administrator at RG-Apps. The User Access Administrator role at the RG-Apps scope allows the support lead to manage role assignments (grant or revoke access) for others without having permissions to modify resource configurations. This role is specifically designed for delegating access management while preventing changes to the resources themselves, which aligns with the requirement.

Answer

Owner at RG-Apps

Answer

Contributor at RG-Apps

Answer

Reader at RG-Apps

Question 12

Based on the exhibit, which change should the administrator make so the application identity remains stable across VM redeployments without reapplying RBAC assignments?

Accepted Answer

Create a user-assigned managed identity and attach it to the VM template.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently of VM redeployments. By attaching the same user-assigned identity to the new VM instance, the application retains its Microsoft Entra ID object ID and all existing RBAC role assignments remain valid without requiring reapplication.

Answer

Keep the system-assigned identity and reapply the same RBAC roles after each rebuild.

Answer

Store a local administrator password in Key Vault and use it for Azure resource access.

Answer

Replace the identity with a shared access signature so the VM can authenticate to Azure services.

Question 13

A finance analyst needs read-only access to one storage account named stprod01. The analyst must not see other resources in the subscription. Where should you assign the Reader role?

Accepted Answer

At the storage account resource scope. Assigning the Reader role at the storage account resource scope (stprod01) grants read-only access exclusively to that specific storage account. This meets the requirement of restricting the analyst from seeing any other resources in the subscription, as role assignments at a higher scope (e.g., resource group, subscription, management group) would inherit permissions to all resources under that scope.

Answer

At the management group scope that contains the subscription

Answer

At the subscription scope that contains the storage account

Answer

At the resource group that contains the storage account

Question 14

Based on the exhibit, a script running on an Azure VM must create resources in another subscription without using passwords or client secrets. Which command should the administrator use first?

Accepted Answer

az login --identity. The script must authenticate without passwords or client secrets, and Azure VMs can use a managed identity for this purpose. The `az login --identity` command authenticates the Azure CLI using the VM's managed identity, which is a passwordless, secretless authentication method. This allows the script to obtain tokens for accessing resources in another subscription, provided the managed identity has appropriate RBAC permissions.

Answer

az login --service-principal

Answer

az account set --subscription <subscriptionId>

Answer

Connect-AzAccount -UseDeviceAuthentication

Question 15

A ReadOnly lock is applied to RG-App. Which two requested changes will fail because of the lock? Select two.

Accepted Answer

Resize a virtual machine to a larger SKU.. A ReadOnly lock on a resource group prevents any operations that modify existing resources or create/delete resources within that group. Resizing a VM to a larger SKU requires a write operation to the VM resource (specifically, updating the hardware profile), which is blocked by the lock. Deleting an unused public IP address is also a write operation (delete), which is blocked. Read operations, such as listing resources or viewing tags, are allowed.

Answer

List the resources currently in the resource group.

Answer

Read the current tag values on the resource group.

Answer

View the VM power state in the portal.