AZ-104 Manage Azure Identities and Governance Practice Test 16 — 15 Questions

Question 1

The platform team wants to block deployment of virtual machines that use any size except a small approved list. Operators already have Contributor access and should keep that access for other tasks. Which Azure control should the administrator use to enforce the size restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign an Azure Policy with an allowed virtual machine size rule and the Deny effect at the subscription scope.. Azure Policy with the 'allowed virtual machine sizes' built-in policy and the Deny effect is the correct control because it enforces a deny action at the resource creation or update level, preventing any VM deployment that does not match the approved size list. This works independently of RBAC permissions, so operators retain their Contributor role for other tasks while the policy blocks non-compliant VM sizes. The policy is assigned at the subscription scope to cover all resource groups, ensuring consistent enforcement across the environment.

Answer

Create a custom RBAC role that excludes unsupported VM sizes from the Contributor role.

Answer

Apply a CanNotDelete lock to the resource group that contains the virtual machines.

Answer

Assign Reader permissions to the operators and rely on Azure portal validation.

Question 2

A DevOps engineer must run an Azure CLI script from a Windows VM to create resources in a specific resource group in another subscription. The script must not use a client secret or password, and access should be limited to only that resource group. Which three actions should the administrator take? Select three.

Accepted Answer

Enable a system-assigned managed identity on the source VM so the script can authenticate without stored credentials.. Enabling a system-assigned managed identity on the source VM allows the Azure CLI script to authenticate to Azure without storing any client secret or password. The managed identity is automatically managed by Microsoft Entra ID and tied to the VM lifecycle, eliminating the need for credential management.

Answer

Create a service principal and store its client secret in a file on the VM for the script to read.

Answer

Grant Reader on the resource group because Reader permissions are sufficient for Azure CLI resource creation.

Question 3

Based on the exhibit, help desk staff must restart virtual machines only in RG-App. What is the narrowest scope where you should assign the role?

Accepted Answer

Assign the role at the RG-App resource group scope.. The narrowest scope that grants the necessary permissions to restart VMs only in RG-App is the resource group scope. Assigning the Virtual Machine Contributor role at the RG-App resource group level ensures that help desk staff can restart VMs within that specific resource group without having permissions to any other resources in the subscription or management group. This follows the principle of least privilege, limiting access to only what is required.

Answer

Assign the role at the subscription scope for Sub-IT-01.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role at the individual VM scope only.

Question 4

A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?

Accepted Answer

An Azure Policy initiative assigned at the management group.. An Azure Policy initiative (also known as a policy set) allows you to group multiple individual policy definitions—such as allowed regions, required tags, and approved VM sizes—into a single assignment. When assigned at the management group scope, the initiative enforces all three rules across every subscription within that group and provides a unified compliance view in the Azure Policy dashboard, meeting the team's requirement for consolidated governance.

Answer

A single RBAC role assignment at the management group.

Answer

A management lock on each subscription.

Answer

A private endpoint for Azure Resource Manager.

Question 5

Based on the exhibit, a subscription policy must add CostCenter=042 to new resources, and deployments must not fail if the tag is missing. Which policy effect should you use?

Accepted Answer

Modify. The 'Modify' effect (option D) is correct because it can add the CostCenter=042 tag to new resources without causing deployment failures if the tag is missing. Unlike 'Deny', which blocks non-compliant resources, 'Modify' uses a 'merge' operation to add tags during resource creation or update, and its 'conflictEffect' can be set to 'audit' to allow deployments to succeed. 'Append' is not deprecated and can also add tags, but 'Modify' is the recommended effect for tag management because it supports conflict resolution and can update existing tags.

Answer

Deny

Answer

Audit

Answer

Append

Question 6

A developer wants to give one Azure VM access to Azure Storage now, and that identity should be removed automatically if the VM is deleted. Which identity type should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, Azure automatically removes the identity from Microsoft Entra ID and revokes any associated role assignments, fulfilling the developer's requirement for automatic cleanup. This identity is created and managed by Azure without any additional administrative overhead.

Answer

A user-assigned managed identity

Answer

A storage account SAS token

Answer

An NSG service tag

Question 7

A modify policy that appends a CostCenter tag was assigned to a management group. The policy shows as assigned, but older virtual machines still lack the tag. What must the administrator do to update those existing resources?

Accepted Answer

Create a remediation task for the policy assignment.. The 'modify' policy effect appends the CostCenter tag to new or updated resources automatically, but it does not retroactively apply to existing resources. To update older virtual machines that lack the tag, the administrator must create a remediation task for the policy assignment. This task uses Azure Policy's 'deployIfNotExists' or 'modify' effect to trigger a deployment that evaluates and corrects non-compliant existing resources.

Answer

Reassign the policy at a lower scope so it applies more quickly.

Answer

Change the policy effect from modify to audit.

Answer

Add a CanNotDelete lock to the virtual machines.

Question 8

During a change freeze, administrators must prevent deletion of a production resource group and all resources inside it, but they still need to update VM sizes and tags. Which lock should be applied?

Accepted Answer

CanNotDelete on the resource group. The CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM sizes and tags. This meets the requirement of blocking deletions during the change freeze without restricting updates. ReadOnly locks would block all write operations, including the needed updates.

Answer

ReadOnly on the resource group

Answer

CanNotDelete on the management group

Answer

An Azure Policy deny assignment

Question 9

A platform team must enforce two governance rules across every current and future subscription under a management group: resources must include an Environment tag, and only East US or West US may be used for deployment. They want one compliance view for both rules and a way to correct missing tags on existing resources where supported. What should they assign?

Accepted Answer

Assign an initiative at the management group scope that contains the tag and allowed-location policies, then remediate the tag policy.. An initiative (policy set) at the management group scope enforces both the required tag and allowed-location rules across all current and future subscriptions in a single compliance view. The tag policy can be remediated using a remediation task with a managed identity to automatically add missing tags on existing resources where supported (e.g., via modify effect). This approach centralizes governance without manual per-subscription assignment.

Answer

Assign two separate policies manually to each subscription and skip remediation.

Answer

Assign Contributor to the management group so administrators can fix any noncompliant resource manually.

Answer

Apply a CanNotDelete lock at the management group scope to prevent drift.

Question 10

A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.

Accepted Answer

Assign an allowed-locations policy at the management group or subscription scope.. Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.

Answer

Create a custom RBAC role that blocks resources deployed outside approved regions.

Answer

Add a CanNotDelete lock to every resource group.

Answer

Grant User Access Administrator to the deployment team.

Question 11

A team operates two Azure VMs that both need to call Azure services with the same identity. The VMs are rebuilt frequently, and the identity must continue to work if either VM is deleted and recreated. Which identity should the administrator attach?

Accepted Answer

A user-assigned managed identity attached to both VMs. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be attached to multiple VMs. When a VM is deleted and recreated, the identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure services without credential management.

Answer

A system-assigned managed identity on one of the VMs

Answer

A service principal with a client secret stored on each VM

Answer

A certificate uploaded to each VM and used for Azure sign-in

Question 12

Three Azure VMs in different resource groups need to access the same Azure resources using one identity. The identity must keep working if any VM is deleted and recreated. What should the administrator assign to the VMs?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs, even across different resource groups. If a VM is deleted and recreated, the user-assigned identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure resources without reconfiguration.

Answer

A system-assigned managed identity on each VM.

Answer

A local administrator account.

Answer

An Azure Blueprint assignment.

Question 13

An enterprise uses one management group to contain five subscriptions for a business unit. A compliance auditor in an Entra ID group needs read-only access to every current and future resource in all five subscriptions, but must not see resources in other business units. What is the best scope for the Reader role assignment?

Accepted Answer

Assign Reader at the management group that contains the five subscriptions.. Assigning the Reader role at the management group scope grants inherited read-only access to all current and future resources within every subscription under that management group, while preventing access to resources in other business units that are in separate management groups. This satisfies the auditor's requirement for a single, scalable assignment that automatically covers new subscriptions added to the management group.

Answer

Assign Reader separately at each subscription in the business unit.

Answer

Assign Reader at a single resource group within one subscription.

Answer

Assign Reader directly to each resource that the auditor should see.

Question 14

Based on the exhibit, where should the administrator go to see which resources are non-compliant with the assigned policy?

Accepted Answer

Azure Policy compliance view.. The Azure Policy compliance view is the correct place to see which resources are non-compliant with assigned policies. This view aggregates compliance states across all policies and initiatives, showing a per-resource breakdown of compliant, non-compliant, and exempt statuses. It directly reflects the evaluation results from the Azure Policy engine, which runs periodic scans and on-demand evaluations.

Answer

Entra ID users and groups.

Answer

Azure Activity log only.

Answer

Resource locks blade.

Question 15

A PowerShell script runs on an Azure VM every night and uses Azure CLI commands to create tags and VM resources in another subscription. The script cannot store a password or client secret. What should it use to authenticate to Azure?

Accepted Answer

az login --identity.. The script runs on an Azure VM and can use a managed identity to authenticate without storing any secrets. The `az login --identity` command uses the VM's system-assigned or user-assigned managed identity to obtain an Microsoft Entra ID access token via the Azure Instance Metadata Service (IMDS) endpoint. This satisfies the requirement of no password or client secret storage.

Answer

az login with a username and password.

Answer

Connect-AzAccount with device code authentication.

Answer

An app registration secret stored in a PowerShell variable.