AZ-104 Manage Azure Identities and Governance Practice Test 17 — 15 Questions

Question 1

A company uses one management group for all production subscriptions. A compliance analyst is a member of an Entra ID group and must view every current and future resource in all production subscriptions, but must not make any changes. Where should you assign the Reader role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign Reader to the Entra ID group at the management group scope.. Assigning the Reader role to the Entra ID group at the management group scope ensures that all current and future resources in all production subscriptions inherit the role via Azure RBAC inheritance. This meets the requirement to view every resource without making changes, as the management group encompasses all production subscriptions and the group membership automatically grants permissions to the compliance analyst.

Answer

Assign Reader to the compliance analyst's user account at each resource group.

Answer

Assign Reader to one production subscription and rely on inheritance to cover the others.

Answer

Assign Reader directly to each resource because resource-level assignments always override broader scopes.

Question 2

The platform team wants to block deployment of Azure resources in any region except East US and West US. What should they configure?

Accepted Answer

An Azure Policy assignment that uses an allowed locations policy. Azure Policy's 'allowed locations' built-in policy definition enables you to restrict the regions where resources can be deployed. By assigning this policy at a management group or subscription scope with a parameter list containing only 'East US' and 'West US', any attempt to deploy resources in other regions will be denied at the Azure Resource Manager level, effectively blocking non-compliant deployments.

Answer

A Reader role assignment at the management group

Answer

A CanNotDelete lock on the subscription

Answer

A tag requirement enforced only by resource group naming

Question 3

An administrator assigned a policy definition with the Modify effect to add tag Environment=Prod to resources in a subscription. Existing VMs still do not show the tag. Which two actions should the administrator take to bring the existing VMs into compliance? Select two.

Accepted Answer

Create a remediation task for the policy assignment.. A is correct because a policy with the Modify effect does not automatically apply to existing non-compliant resources; a remediation task must be triggered to evaluate and update those resources. Remediation uses the managed identity assigned to the policy to perform the modification, which is why verifying that identity has the necessary permissions (option B) is also required. Without remediation, only new resources created after the policy assignment will have the tag applied.

Answer

Reassign the policy at the resource group scope only.

Answer

Switch the policy effect to AuditIfNotExists.

Answer

Manually tag only the newest virtual machines.

Question 4

Based on the exhibit, which Azure service is preventing deployment because the resource is missing a required tag?

Accepted Answer

Azure Policy. Azure Policy is the correct answer because it enforces organizational standards and compliance rules, such as requiring specific tags on resources. When a policy is defined to require a tag (e.g., 'CostCenter') and a deployment attempts to create a resource without that tag, Azure Policy evaluates the request against the policy assignment and denies the deployment. This is a built-in capability of Azure Policy, not a permission or lock mechanism.

Answer

Azure RBAC

Answer

Resource locks

Answer

Azure Monitor

Question 5

An Azure CLI script runs on a utility VM every night to create and tag resources in another subscription. The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image. What is the best identity design?

Accepted Answer

Create a user-assigned managed identity and attach it to the utility VM. A user-assigned managed identity can be created once, assigned to the utility VM, and used across redeployments without storing any credentials. The script can authenticate via Azure CLI using the managed identity's client ID, and the identity persists independently of the VM's lifecycle, satisfying the requirement of no password or client secret storage.

Answer

Assign a system-assigned managed identity to the utility VM

Answer

Create a service principal and store its secret in the VM configuration

Answer

Use a shared access signature to sign the Azure CLI session

Question 6

A contractor from a partner company needs read-only access to one application resource group for 14 days. When the contractor leaves the project, access should be removed immediately by removing a single identity from a group. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Entra ID security group for the contractor team.. Creating an Entra ID security group for the contractor team (Option A) allows the administrator to manage access centrally. By assigning the Reader role to that group at the application resource group scope (Option B), all members inherit read-only permissions. When the contractor leaves, removing their user object from the group immediately revokes access without needing to modify role assignments, satisfying the requirement for a single identity removal.

Answer

Assign Reader directly to the contractor's user object at the subscription scope.

Answer

Assign Contributor at the resource group scope and rely on discipline.

Answer

Use a resource lock to limit the contractor to read-only access.

Question 7

An administrator wants a script running on an Azure VM to create a resource in Azure without storing any passwords or client secrets on the VM. What should the administrator configure first?

Accepted Answer

A system-assigned managed identity on the VM. A system-assigned managed identity enables an Azure VM to authenticate to Azure services (e.g., Azure Resource Manager) without storing any credentials in the VM. The identity is automatically created and managed by Azure, and the VM can obtain an access token from Azure AD via the Instance Metadata Service (IMDS) endpoint (169.254.169.254) using a simple HTTP call. This allows the script to securely create resources without hardcoding passwords or client secrets.

Answer

A shared local account on the VM

Answer

An Azure Policy exemption

Answer

A public IP address on the VM

Question 8

A company has 12 subscriptions under one management group. An external auditor needs Reader access to resources in every current and future subscription under that management group. Where should you assign the role?

Accepted Answer

At the management group scope. Assigning the Reader role at the management group scope ensures that the external auditor inherits read-only access to all current and future subscriptions under that management group. Role assignments at the management group scope are inherited by all child subscriptions and resource groups, making it the single, scalable solution for the requirement.

Answer

At each resource group in each subscription

Answer

At one subscription scope only

Answer

At one resource scope in the first subscription

Question 9

The platform team wants every resource deployed in a subscription to include an Environment tag. New resources that do not meet the rule must be blocked, and existing noncompliant resources should appear in compliance reports. What should be configured?

Accepted Answer

An Azure Policy assignment at the subscription scope with a deny effect.. Azure Policy with a deny effect at the subscription scope is the correct choice because it enforces a rule that blocks the creation or update of any resource that does not include the required 'Environment' tag. The deny effect actively prevents noncompliant deployments, while the policy itself evaluates existing resources and marks them as noncompliant in compliance reports, meeting both requirements.

Answer

A Contributor role assignment at the subscription scope.

Answer

A resource lock on the subscription.

Answer

A custom RBAC role that includes tag write permissions.

Question 10

During a change freeze, the operations team wants to prevent accidental deletion of a production resource group and everything in it. They still need to update VM settings, change tags, and modify network rules. Which lock should be applied?

Accepted Answer

Apply a CanNotDelete lock to the resource group.. The CanNotDelete lock (Option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM settings, changing tags, and updating network rules. This lock type is specifically designed to protect against accidental deletion during a change freeze without blocking management operations.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Assign the Reader role to all operators.

Answer

Assign an Azure Policy deny assignment at the subscription.

Question 11

A team has 20 operators who need the same Reader access to one application resource group. You want to grant access and later revoke it by changing group membership instead of editing each user's permissions. What should you use for the role assignment?

Accepted Answer

An Entra ID security group. Using an Entra ID security group allows you to assign the Reader role to the group, then add or remove the 20 operators as members. This centralizes permission management: granting or revoking access is done by changing group membership rather than editing individual role assignments, which is more efficient and less error-prone.

Answer

Individual user accounts

Answer

A management group

Answer

A resource lock

Question 12

A finance team wants every resource created in one production resource group to carry CostCenter=PRD automatically. They do not want deployments blocked if a team forgets the tag, but they do want existing resources and future resources in that resource group to converge on the correct tag value. What should the administrator configure?

Accepted Answer

Assign a modify policy for CostCenter=PRD at the production resource group scope and create a remediation task.. Azure Policy with a 'modify' effect can automatically add or correct the CostCenter tag on resources within the specified scope. By assigning the policy at the production resource group scope and creating a remediation task, the policy will audit existing resources and, via a managed identity, apply the tag value to non-compliant resources without blocking deployment. This satisfies the requirement for automatic convergence without preventing creation if the tag is missing.

Answer

Apply a CanNotDelete lock to the production resource group.

Answer

Assign Contributor on the subscription and require teams to enter the tag manually.

Answer

Set the tag on the management group and expect all resources to inherit it automatically.

Question 13

An administrator wants to let a help desk group start, stop, and restart virtual machines in one resource group, but the group must not be able to delete the VMs or any other resource in the group. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role with only VM start, stop, restart, and read actions.. Creating a custom RBAC role with only VM start, stop, restart, and read actions ensures the help desk group can perform only those specific operations without any delete permissions. This role must be assigned at the resource group scope (Option B) to limit its effect to that resource group, preventing the group from modifying or deleting resources in other scopes. Together, these two actions fulfill the requirement precisely.

Answer

Assign Virtual Machine Contributor to the help desk group.

Answer

Apply a CanNotDelete lock to the resource group.

Answer

Use Azure Policy to block VM deletion and leave RBAC unchanged.

Question 14

A team can already deploy virtual machines, but they want to prevent users from creating VMs unless the deployment includes an approved tag. They also want to see which existing resources do not meet the rule. What should the administrator use?

Accepted Answer

An Azure Policy assignment with a deny or audit effect for the tag requirement.. Azure Policy with a 'deny' effect prevents creation of VMs that lack the required tag, while the 'audit' effect identifies non-compliant existing resources without blocking them. This directly addresses both requirements: enforcing the tag on new deployments and discovering which existing resources violate the rule.

Answer

A custom RBAC role that removes the create action for virtual machines.

Answer

A resource lock on the resource group.

Answer

An Entra ID dynamic group for the VM creators.

Question 15

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. You need to ensure that all resources deployed in the production subscription adhere to specific regulatory compliance requirements, such as encryption at rest and denying public network access. Which three of the following should you implement? (Choose three.)

Accepted Answer

Assign a custom Azure Policy definition at the management group that contains the production subscription.. Creating a custom Azure Policy definition allows you to enforce specific regulatory requirements like encryption at rest and denying public network access. Assigning this custom policy at the management group that contains the production subscription ensures the policy is inherited by the subscription and all its resources. Configuring Azure Blueprints to include the custom policy assignment and assigning the blueprint to the production subscription provides a repeatable, versioned deployment of the policy along with other artifacts, ensuring consistent governance.

Answer

Use Azure Resource Graph to audit resources that do not meet compliance requirements.

Answer

Assign the built-in Azure Policy initiative 'ISO 27001:2013' to the production subscription.

Answer

Create an Azure role-based access control (RBAC) role to enforce encryption and network restrictions.