AZ-104 Manage Azure Identities and Governance Practice Test 15 — 15 Questions

Question 1

Based on the exhibit, an administrator wants to prevent new Azure resources from being deployed in any region except East US and West US across the entire Corp hierarchy. What should the administrator configure?

Accepted Answer

Create and assign an Azure Policy at the Corp management group using the allowed locations rule.. Azure Policy is the correct tool to enforce governance rules across management groups. The 'allowed locations' built-in policy definition restricts resource deployment to specified regions. By assigning this policy at the Corp management group, the rule applies to all child subscriptions and resources, preventing deployment in any region except East US and West US.

Answer

Assign a built-in RBAC role that denies deployments in unsupported regions.

Answer

Apply a CanNotDelete lock to the subscriptions.

Answer

Use a resource tag named RegionApproved and require teams to set it manually.

Question 2

Based on the exhibit, a support lead must manage role assignments for RG-Apps so the team can grant or revoke access for others. The support lead must not be able to change resource configurations. Which role should you assign?

Accepted Answer

User Access Administrator at RG-Apps. The User Access Administrator role at the RG-Apps scope allows the support lead to manage role assignments (grant or revoke access) for others without having permissions to modify resource configurations. This role is specifically designed for delegating access management while preventing changes to the resources themselves, which aligns with the requirement.

Answer

Owner at RG-Apps

Answer

Contributor at RG-Apps

Answer

Reader at RG-Apps

Question 3

Based on the exhibit, which change should the administrator make so the application identity remains stable across VM redeployments without reapplying RBAC assignments?

Accepted Answer

Create a user-assigned managed identity and attach it to the VM template.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently of VM redeployments. By attaching the same user-assigned identity to the new VM instance, the application retains its Azure AD object ID and all existing RBAC role assignments remain valid without requiring reapplication.

Answer

Keep the system-assigned identity and reapply the same RBAC roles after each rebuild.

Answer

Store a local administrator password in Key Vault and use it for Azure resource access.

Answer

Replace the identity with a shared access signature so the VM can authenticate to Azure services.

Question 4

A finance analyst needs read-only access to one storage account named stprod01. The analyst must not see other resources in the subscription. Where should you assign the Reader role?

Accepted Answer

At the storage account resource scope. Assigning the Reader role at the storage account resource scope (stprod01) grants read-only access exclusively to that specific storage account. This meets the requirement of restricting the analyst from seeing any other resources in the subscription, as role assignments at a higher scope (e.g., resource group, subscription, management group) would inherit permissions to all resources under that scope.

Answer

At the management group scope that contains the subscription

Answer

At the subscription scope that contains the storage account

Answer

At the resource group that contains the storage account

Question 5

Based on the exhibit, a script running on an Azure VM must create resources in another subscription without using passwords or client secrets. Which command should the administrator use first?

Accepted Answer

az login --identity. Option A is correct because the script must authenticate without passwords or client secrets, and Azure VMs can use a managed identity for this purpose. The `az login --identity` command authenticates the Azure CLI using the VM's managed identity, which is a passwordless, secretless authentication method. This allows the script to obtain tokens for accessing resources in another subscription, provided the managed identity has appropriate RBAC permissions.

Answer

az login --service-principal

Answer

az account set --subscription <subscriptionId>

Answer

Connect-AzAccount -UseDeviceAuthentication

Question 6

A ReadOnly lock is applied to RG-App. Which two requested changes will fail because of the lock? Select two.

Accepted Answer

Resize a virtual machine to a larger SKU.. A ReadOnly lock on a resource group prevents any operations that modify existing resources or create/delete resources within that group. Resizing a VM to a larger SKU requires a write operation to the VM resource (specifically, updating the hardware profile), which is blocked by the lock. Deleting an unused public IP address is also a write operation (delete), which is blocked. Read operations, such as listing resources or viewing tags, are allowed.

Answer

List the resources currently in the resource group.

Answer

Read the current tag values on the resource group.

Answer

View the VM power state in the portal.

Question 7

The platform team wants to block deployment of virtual machines that use any size except a small approved list. Operators already have Contributor access and should keep that access for other tasks. Which Azure control should the administrator use to enforce the size restriction?

Accepted Answer

Assign an Azure Policy with an allowed virtual machine size rule and the Deny effect at the subscription scope.. Azure Policy with the 'allowed virtual machine sizes' built-in policy and the Deny effect is the correct control because it enforces a deny action at the resource creation or update level, preventing any VM deployment that does not match the approved size list. This works independently of RBAC permissions, so operators retain their Contributor role for other tasks while the policy blocks non-compliant VM sizes. The policy is assigned at the subscription scope to cover all resource groups, ensuring consistent enforcement across the environment.

Answer

Create a custom RBAC role that excludes unsupported VM sizes from the Contributor role.

Answer

Apply a CanNotDelete lock to the resource group that contains the virtual machines.

Answer

Assign Reader permissions to the operators and rely on Azure portal validation.

Question 8

A DevOps engineer must run an Azure CLI script from a Windows VM to create resources in a specific resource group in another subscription. The script must not use a client secret or password, and access should be limited to only that resource group. Which three actions should the administrator take? Select three.

Accepted Answer

Enable a system-assigned managed identity on the source VM so the script can authenticate without stored credentials.. Option A is correct because enabling a system-assigned managed identity on the source VM allows the Azure CLI script to authenticate to Azure without storing any client secret or password. The managed identity is automatically managed by Azure AD and tied to the VM lifecycle, eliminating the need for credential management.

Answer

Create a service principal and store its client secret in a file on the VM for the script to read.

Answer

Grant Reader on the resource group because Reader permissions are sufficient for Azure CLI resource creation.

Question 9

Based on the exhibit, help desk staff must restart virtual machines only in RG-App. What is the narrowest scope where you should assign the role?

Accepted Answer

Assign the role at the RG-App resource group scope.. The narrowest scope that grants the necessary permissions to restart VMs only in RG-App is the resource group scope. Assigning the Virtual Machine Contributor role at the RG-App resource group level ensures that help desk staff can restart VMs within that specific resource group without having permissions to any other resources in the subscription or management group. This follows the principle of least privilege, limiting access to only what is required.

Answer

Assign the role at the subscription scope for Sub-IT-01.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role at the individual VM scope only.

Question 10

A security team wants operators in one resource group to start, stop, and restart virtual machines, but they must not create VMs, delete VMs, or manage disks and networking. What should the administrator configure?

Accepted Answer

Create a custom RBAC role with only the VM power actions and assign it at the resource group scope.. The correct answer is C because the built-in roles (Contributor and Virtual Machine Contributor) grant more permissions than needed, including the ability to create or delete VMs and manage networking. A custom RBAC role with only the specific power actions (start, stop, restart) ensures least privilege, meeting the security team's requirement exactly.

Answer

Assign the Contributor role at the resource group scope.

Answer

Assign the Virtual Machine Contributor role at the resource group scope.

Answer

Use Azure Policy to deny creation of new VMs in the resource group.

Question 11

A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?

Accepted Answer

An Azure Policy initiative assigned at the management group.. An Azure Policy initiative (also known as a policy set) allows you to group multiple individual policy definitions—such as allowed regions, required tags, and approved VM sizes—into a single assignment. When assigned at the management group scope, the initiative enforces all three rules across every subscription within that group and provides a unified compliance view in the Azure Policy dashboard, meeting the team's requirement for consolidated governance.

Answer

A single RBAC role assignment at the management group.

Answer

A management lock on each subscription.

Answer

A private endpoint for Azure Resource Manager.

Question 12

A production resource group must be protected from accidental deletion during a change freeze. Administrators still need to update VM sizes, rotate tags, and change NSG rules. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Option A is correct because applying a CanNotDelete lock to the resource group prevents the entire resource group from being deleted, while still allowing administrators to update VM sizes, rotate tags, and modify NSG rules. This lock type blocks delete operations but permits all read and write operations, aligning with the requirement to protect against accidental deletion during a change freeze while maintaining administrative flexibility.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Use Azure Policy to deny all delete requests.

Answer

Add a Protected=true tag and use it to prevent deletion.

Question 13

Based on the exhibit, a subscription policy must add CostCenter=042 to new resources, and deployments must not fail if the tag is missing. Which policy effect should you use?

Accepted Answer

Modify. The 'Modify' effect (option D) is correct because it can add the CostCenter=042 tag to new resources without causing deployment failures if the tag is missing. Unlike 'Deny', which blocks non-compliant resources, or 'Append', which is deprecated and only works on non-tag properties, 'Modify' uses a 'merge' operation to add tags during resource creation or update, and its 'conflictEffect' can be set to 'audit' to ensure deployments succeed even when the tag is absent.

Answer

Deny

Answer

Audit

Answer

Append

Question 14

A developer wants to give one Azure VM access to Azure Storage now, and that identity should be removed automatically if the VM is deleted. Which identity type should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, Azure automatically removes the identity from Azure AD and revokes any associated role assignments, fulfilling the developer's requirement for automatic cleanup. This identity is created and managed by Azure without any additional administrative overhead.

Answer

A user-assigned managed identity

Answer

A storage account SAS token

Answer

An NSG service tag

Question 15

A modify policy that appends a CostCenter tag was assigned to a management group. The policy shows as assigned, but older virtual machines still lack the tag. What must the administrator do to update those existing resources?

Accepted Answer

Create a remediation task for the policy assignment.. The 'modify' policy effect appends the CostCenter tag to new or updated resources automatically, but it does not retroactively apply to existing resources. To update older virtual machines that lack the tag, the administrator must create a remediation task for the policy assignment. This task uses Azure Policy's 'deployIfNotExists' or 'modify' effect to trigger a deployment that evaluates and corrects non-compliant existing resources.

Answer

Reassign the policy at a lower scope so it applies more quickly.

Answer

Change the policy effect from modify to audit.

Answer

Add a CanNotDelete lock to the virtual machines.

AZ-104 Manage Azure Identities and Governance Practice Test 15 — 15 Questions

Exhibit

AZ-104 Manage Azure Identities and Governance Practice Test 15 — 15 Questions

Exhibit