AZ-104 Manage Azure Identities and Governance Practice Test 16 — 15 Questions

Question 1

A modify policy that appends a CostCenter tag was assigned to a management group. The policy shows as assigned, but older virtual machines still lack the tag. What must the administrator do to update those existing resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a remediation task for the policy assignment.. The 'modify' policy effect appends the CostCenter tag to new or updated resources automatically, but it does not retroactively apply to existing resources. To update older virtual machines that lack the tag, the administrator must create a remediation task for the policy assignment. This task uses Azure Policy's 'deployIfNotExists' or 'modify' effect to trigger a deployment that evaluates and corrects non-compliant existing resources.

Answer

Reassign the policy at a lower scope so it applies more quickly.

Answer

Change the policy effect from modify to audit.

Answer

Add a CanNotDelete lock to the virtual machines.

Question 2

During a change freeze, administrators must prevent deletion of a production resource group and all resources inside it, but they still need to update VM sizes and tags. Which lock should be applied?

Accepted Answer

CanNotDelete on the resource group. The CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM sizes and tags. This meets the requirement of blocking deletions during the change freeze without restricting updates. ReadOnly locks would block all write operations, including the needed updates.

Answer

ReadOnly on the resource group

Answer

CanNotDelete on the management group

Answer

An Azure Policy deny assignment

Question 3

A platform team must enforce two governance rules across every current and future subscription under a management group: resources must include an Environment tag, and only East US or West US may be used for deployment. They want one compliance view for both rules and a way to correct missing tags on existing resources where supported. What should they assign?

Accepted Answer

Assign an initiative at the management group scope that contains the tag and allowed-location policies, then remediate the tag policy.. An initiative (policy set) at the management group scope enforces both the required tag and allowed-location rules across all current and future subscriptions in a single compliance view. The tag policy can be remediated using a remediation task with a managed identity to automatically add missing tags on existing resources where supported (e.g., via modify effect). This approach centralizes governance without manual per-subscription assignment.

Answer

Assign two separate policies manually to each subscription and skip remediation.

Answer

Assign Contributor to the management group so administrators can fix any noncompliant resource manually.

Answer

Apply a CanNotDelete lock at the management group scope to prevent drift.

Question 4

A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.

Accepted Answer

Assign an allowed-locations policy at the management group or subscription scope.. Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.

Answer

Create a custom RBAC role that blocks resources deployed outside approved regions.

Answer

Add a CanNotDelete lock to every resource group.

Answer

Grant User Access Administrator to the deployment team.

Question 5

A team operates two Azure VMs that both need to call Azure services with the same identity. The VMs are rebuilt frequently, and the identity must continue to work if either VM is deleted and recreated. Which identity should the administrator attach?

Accepted Answer

A user-assigned managed identity attached to both VMs. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be attached to multiple VMs. When a VM is deleted and recreated, the identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure services without credential management.

Answer

A system-assigned managed identity on one of the VMs

Answer

A service principal with a client secret stored on each VM

Answer

A certificate uploaded to each VM and used for Azure sign-in

Question 6

Three Azure VMs in different resource groups need to access the same Azure resources using one identity. The identity must keep working if any VM is deleted and recreated. What should the administrator assign to the VMs?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs, even across different resource groups. If a VM is deleted and recreated, the user-assigned identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure resources without reconfiguration.

Answer

A system-assigned managed identity on each VM.

Answer

A local administrator account.

Answer

An Azure Blueprint assignment.

Question 7

An enterprise uses one management group to contain five subscriptions for a business unit. A compliance auditor in an Entra ID group needs read-only access to every current and future resource in all five subscriptions, but must not see resources in other business units. What is the best scope for the Reader role assignment?

Accepted Answer

Assign Reader at the management group that contains the five subscriptions.. Assigning the Reader role at the management group scope grants inherited read-only access to all current and future resources within every subscription under that management group, while preventing access to resources in other business units that are in separate management groups. This satisfies the auditor's requirement for a single, scalable assignment that automatically covers new subscriptions added to the management group.

Answer

Assign Reader separately at each subscription in the business unit.

Answer

Assign Reader at a single resource group within one subscription.

Answer

Assign Reader directly to each resource that the auditor should see.

Question 8

Based on the exhibit, where should the administrator go to see which resources are non-compliant with the assigned policy?

Accepted Answer

Azure Policy compliance view.. The Azure Policy compliance view is the correct place to see which resources are non-compliant with assigned policies. This view aggregates compliance states across all policies and initiatives, showing a per-resource breakdown of compliant, non-compliant, and exempt statuses. It directly reflects the evaluation results from the Azure Policy engine, which runs periodic scans and on-demand evaluations.

Answer

Entra ID users and groups.

Answer

Azure Activity log only.

Answer

Resource locks blade.

Question 9

A PowerShell script runs on an Azure VM every night and uses Azure CLI commands to create tags and VM resources in another subscription. The script cannot store a password or client secret. What should it use to authenticate to Azure?

Accepted Answer

az login --identity.. The script runs on an Azure VM and can use a managed identity to authenticate without storing any secrets. The `az login --identity` command uses the VM's system-assigned or user-assigned managed identity to obtain an Azure AD access token via the Azure Instance Metadata Service (IMDS) endpoint. This satisfies the requirement of no password or client secret storage.

Answer

az login with a username and password.

Answer

Connect-AzAccount with device code authentication.

Answer

An app registration secret stored in a PowerShell variable.

Question 10

A newly created VM must read secrets from Azure Key Vault. The solution must not store credentials on the VM, and the identity should disappear automatically when the VM is deleted. What should the administrator enable?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is automatically created and tied to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed, satisfying the requirement that the identity disappears. This identity can be granted access to Key Vault secrets via Azure RBAC or access policies, without storing any credentials on the VM.

Answer

User-assigned managed identity

Answer

A service principal with a stored client secret

Answer

A storage account access key

Question 11

An administrator wants to run a one-time Azure CLI command from inside a VM to create a resource in Azure, but the administrator does not want to store credentials on the VM. What should be used for authentication?

Accepted Answer

The VM's managed identity. Azure Managed Identity provides an automatically managed identity in Azure AD that allows a VM to authenticate to any service that supports Azure AD authentication, including Azure Resource Manager, without storing any credentials on the VM. When the administrator runs the Azure CLI command from within the VM, the CLI can use the managed identity's token endpoint (169.254.169.254/metadata/identity/oauth2/token) to obtain an access token, enabling secure, credential-free resource creation.

Answer

A local administrator password

Answer

A network security group rule

Answer

An Azure region paired with the VM

Question 12

A project team has 12 operators who need to read resource properties and restart only the virtual machines in one application resource group. Access should be removed automatically when an operator leaves the team, and any new VMs added to that resource group should inherit the same access without further changes. What should the administrator configure?

Accepted Answer

Create an Entra ID group, add the operators to it, and assign a custom least-privilege role to the group at the resource group scope.. It uses an Entra ID group to manage access, which allows automatic removal of operators from the group when they leave the team, and any new VMs added to the resource group will inherit the role assignment at the resource group scope. A custom least-privilege role ensures operators can only read resource properties and restart VMs, meeting the specific requirements without over-permissioning.

Answer

Assign the role directly to each operator at the resource group scope.

Answer

Assign Virtual Machine Contributor to the team at the subscription scope.

Answer

Use a resource lock and add the operators as lock owners.

Question 13

An enterprise has a management group named Corp. Corp contains two child management groups: Prod and Sandbox. A compliance auditor is a member of an Entra ID group and must have read-only access to every current and future resource in all subscriptions that are under Prod. The auditor must not see resources in Sandbox, and the admin does not want to maintain separate assignments for each new subscription. What should the administrator do?

Accepted Answer

Assign the Reader role to the group at the Prod management group scope.. Assigning the Reader role at the Prod management group scope applies that permission to all current and future subscriptions and resources within Prod, satisfying the requirement for read-only access without needing separate assignments. Management groups in Azure provide a hierarchical scope that inherits role assignments to all child subscriptions and resource groups, making this the most efficient and future-proof approach.

Answer

Assign the Reader role to the group at each subscription scope under Prod.

Answer

Assign the Reader role to the group at the Corp management group scope.

Answer

Assign the Reader role to the group at one resource group in each Prod subscription.

Question 14

An Azure administrator deploys a Linux VM that runs an application needing to read secrets from Azure Key Vault. The security policy forbids storing passwords, certificates, or access tokens on the VM. The application will run only on this single VM. What should be enabled on the VM?

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity enables the VM to authenticate to Azure Key Vault without storing any credentials on the VM. Azure automatically creates a service principal in Azure AD for the VM, and the application can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) using that identity. This satisfies the security policy forbidding stored secrets because the identity is managed entirely by Azure and no passwords, certificates, or tokens are stored locally.

Answer

Store a service principal secret in a protected file and use it at startup.

Answer

Create a user-assigned managed identity and avoid assigning it to the VM.

Answer

Use an SSH certificate to authenticate the app to Key Vault.

Question 15

Based on the exhibit, where should you assign the Reader role so the Auditors group can read every current and future resource in the Sales subscription, including resource groups created later, while not granting access to the Research subscription?

Accepted Answer

Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.. Assigning the Reader role at the Sales subscription scope grants the Auditors group read access to all current and future resource groups and resources within that subscription. This is because Azure RBAC roles assigned at a subscription level are inherited by all child resource groups and resources, including those created later. The requirement explicitly excludes the Research subscription, so a subscription-level assignment is the correct and most efficient approach.

Answer

Assign Reader to RG-Web, because the group can then inherit access to resources in that resource group only.

Answer

Assign Reader to the Corp management group, because that is the only scope that can cover multiple subscriptions.

Answer

Assign Reader to each resource individually, because that avoids inheritance and limits visibility to selected items.