AZ-104 Manage Azure Identities and Governance Practice Test 17 — 15 Questions

Question 1

A newly created VM must read secrets from Azure Key Vault. The solution must not store credentials on the VM, and the identity should disappear automatically when the VM is deleted. What should the administrator enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is automatically created and tied to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed, satisfying the requirement that the identity disappears. This identity can be granted access to Key Vault secrets via Azure RBAC or access policies, without storing any credentials on the VM.

Answer

User-assigned managed identity

Answer

A service principal with a stored client secret

Answer

A storage account access key

Question 2

An administrator wants to run a one-time Azure CLI command from inside a VM to create a resource in Azure, but the administrator does not want to store credentials on the VM. What should be used for authentication?

Accepted Answer

The VM's managed identity. Azure Managed Identity provides an automatically managed identity in Microsoft Entra ID that allows a VM to authenticate to any service that supports Microsoft Entra ID authentication, including Azure Resource Manager, without storing any credentials on the VM. When the administrator runs the Azure CLI command from within the VM, the CLI can use the managed identity's token endpoint (169.254.169.254/metadata/identity/oauth2/token) to obtain an access token, enabling secure, credential-free resource creation.

Answer

A local administrator password

Answer

A network security group rule

Answer

An Azure region paired with the VM

Question 3

A project team has 12 operators who need to read resource properties and restart only the virtual machines in one application resource group. Access should be removed automatically when an operator leaves the team, and any new VMs added to that resource group should inherit the same access without further changes. What should the administrator configure?

Accepted Answer

Create an Entra ID group, add the operators to it, and assign a custom least-privilege role to the group at the resource group scope.. It uses an Entra ID group to manage access, which allows automatic removal of operators from the group when they leave the team, and any new VMs added to the resource group will inherit the role assignment at the resource group scope. A custom least-privilege role ensures operators can only read resource properties and restart VMs, meeting the specific requirements without over-permissioning.

Answer

Assign the role directly to each operator at the resource group scope.

Answer

Assign Virtual Machine Contributor to the team at the subscription scope.

Answer

Use a resource lock and add the operators as lock owners.

Question 4

An enterprise has a management group named Corp. Corp contains two child management groups: Prod and Sandbox. A compliance auditor is a member of an Entra ID group and must have read-only access to every current and future resource in all subscriptions that are under Prod. The auditor must not see resources in Sandbox, and the admin does not want to maintain separate assignments for each new subscription. What should the administrator do?

Accepted Answer

Assign the Reader role to the group at the Prod management group scope.. Assigning the Reader role at the Prod management group scope applies that permission to all current and future subscriptions and resources within Prod, satisfying the requirement for read-only access without needing separate assignments. Management groups in Azure provide a hierarchical scope that inherits role assignments to all child subscriptions and resource groups, making this the most efficient and future-proof approach.

Answer

Assign the Reader role to the group at each subscription scope under Prod.

Answer

Assign the Reader role to the group at the Corp management group scope.

Answer

Assign the Reader role to the group at one resource group in each Prod subscription.

Question 5

An Azure administrator deploys a Linux VM that runs an application needing to read secrets from Azure Key Vault. The security policy forbids storing passwords, certificates, or access tokens on the VM. The application will run only on this single VM. What should be enabled on the VM?

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity enables the VM to authenticate to Azure Key Vault without storing any credentials on the VM. Azure automatically creates a service principal in Microsoft Entra ID for the VM, and the application can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) using that identity. This satisfies the security policy forbidding stored secrets because the identity is managed entirely by Azure and no passwords, certificates, or tokens are stored locally.

Answer

Store a service principal secret in a protected file and use it at startup.

Answer

Create a user-assigned managed identity and avoid assigning it to the VM.

Answer

Use an SSH certificate to authenticate the app to Key Vault.

Question 6

Based on the exhibit, where should you assign the Reader role so the Auditors group can read every current and future resource in the Sales subscription, including resource groups created later, while not granting access to the Research subscription?

Accepted Answer

Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.. Assigning the Reader role at the Sales subscription scope grants the Auditors group read access to all current and future resource groups and resources within that subscription. This is because Azure RBAC roles assigned at a subscription level are inherited by all child resource groups and resources, including those created later. The requirement explicitly excludes the Research subscription, so a subscription-level assignment is the correct and most efficient approach.

Answer

Assign Reader to RG-Web, because the group can then inherit access to resources in that resource group only.

Answer

Assign Reader to the Corp management group, because that is the only scope that can cover multiple subscriptions.

Answer

Assign Reader to each resource individually, because that avoids inheritance and limits visibility to selected items.

Question 7

A company uses one management group for all production subscriptions. A compliance analyst is a member of an Entra ID group and must view every current and future resource in all production subscriptions, but must not make any changes. Where should you assign the Reader role?

Accepted Answer

Assign Reader to the Entra ID group at the management group scope.. Assigning the Reader role to the Entra ID group at the management group scope ensures that all current and future resources in all production subscriptions inherit the role via Azure RBAC inheritance. This meets the requirement to view every resource without making changes, as the management group encompasses all production subscriptions and the group membership automatically grants permissions to the compliance analyst.

Answer

Assign Reader to the compliance analyst's user account at each resource group.

Answer

Assign Reader to one production subscription and rely on inheritance to cover the others.

Answer

Assign Reader directly to each resource because resource-level assignments always override broader scopes.

Question 8

The platform team wants to block deployment of Azure resources in any region except East US and West US. What should they configure?

Accepted Answer

An Azure Policy assignment that uses an allowed locations policy. Azure Policy's 'allowed locations' built-in policy definition enables you to restrict the regions where resources can be deployed. By assigning this policy at a management group or subscription scope with a parameter list containing only 'East US' and 'West US', any attempt to deploy resources in other regions will be denied at the Azure Resource Manager level, effectively blocking non-compliant deployments.

Answer

A Reader role assignment at the management group

Answer

A CanNotDelete lock on the subscription

Answer

A tag requirement enforced only by resource group naming

Question 9

An administrator assigned a policy definition with the Modify effect to add tag Environment=Prod to resources in a subscription. Existing VMs still do not show the tag. Which two actions should the administrator take to bring the existing VMs into compliance? Select two.

Accepted Answer

Create a remediation task for the policy assignment.. A is correct because a policy with the Modify effect does not automatically apply to existing non-compliant resources; a remediation task must be triggered to evaluate and update those resources. Remediation uses the managed identity assigned to the policy to perform the modification, which is why verifying that identity has the necessary permissions (option B) is also required. Without remediation, only new resources created after the policy assignment will have the tag applied.

Answer

Reassign the policy at the resource group scope only.

Answer

Switch the policy effect to AuditIfNotExists.

Answer

Manually tag only the newest virtual machines.

Question 10

Based on the exhibit, which Azure service is preventing deployment because the resource is missing a required tag?

Accepted Answer

Azure Policy. Azure Policy is the correct answer because it enforces organizational standards and compliance rules, such as requiring specific tags on resources. When a policy is defined to require a tag (e.g., 'CostCenter') and a deployment attempts to create a resource without that tag, Azure Policy evaluates the request against the policy assignment and denies the deployment. This is a built-in capability of Azure Policy, not a permission or lock mechanism.

Answer

Azure RBAC

Answer

Resource locks

Answer

Azure Monitor

Question 11

An Azure CLI script runs on a utility VM every night to create and tag resources in another subscription. The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image. What is the best identity design?

Accepted Answer

Create a user-assigned managed identity and attach it to the utility VM. A user-assigned managed identity can be created once, assigned to the utility VM, and used across redeployments without storing any credentials. The script can authenticate via Azure CLI using the managed identity's client ID, and the identity persists independently of the VM's lifecycle, satisfying the requirement of no password or client secret storage.

Answer

Assign a system-assigned managed identity to the utility VM

Answer

Create a service principal and store its secret in the VM configuration

Answer

Use a shared access signature to sign the Azure CLI session

Question 12

A contractor from a partner company needs read-only access to one application resource group for 14 days. When the contractor leaves the project, access should be removed immediately by removing a single identity from a group. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Entra ID security group for the contractor team.. Creating an Entra ID security group for the contractor team (Option A) allows the administrator to manage access centrally. By assigning the Reader role to that group at the application resource group scope (Option B), all members inherit read-only permissions. When the contractor leaves, removing their user object from the group immediately revokes access without needing to modify role assignments, satisfying the requirement for a single identity removal.

Answer

Assign Reader directly to the contractor's user object at the subscription scope.

Answer

Assign Contributor at the resource group scope and rely on discipline.

Answer

Use a resource lock to limit the contractor to read-only access.

Question 13

An administrator wants a script running on an Azure VM to create a resource in Azure without storing any passwords or client secrets on the VM. What should the administrator configure first?

Accepted Answer

A system-assigned managed identity on the VM. A system-assigned managed identity enables an Azure VM to authenticate to Azure services (e.g., Azure Resource Manager) without storing any credentials in the VM. The identity is automatically created and managed by Azure, and the VM can obtain an access token from Microsoft Entra ID via the Instance Metadata Service (IMDS) endpoint (169.254.169.254) using a simple HTTP call. This allows the script to securely create resources without hardcoding passwords or client secrets.

Answer

A shared local account on the VM

Answer

An Azure Policy exemption

Answer

A public IP address on the VM

Question 14

A company has 12 subscriptions under one management group. An external auditor needs Reader access to resources in every current and future subscription under that management group. Where should you assign the role?

Accepted Answer

At the management group scope. Assigning the Reader role at the management group scope ensures that the external auditor inherits read-only access to all current and future subscriptions under that management group. Role assignments at the management group scope are inherited by all child subscriptions and resource groups, making it the single, scalable solution for the requirement.

Answer

At each resource group in each subscription

Answer

At one subscription scope only

Answer

At one resource scope in the first subscription

Question 15

The platform team wants every resource deployed in a subscription to include an Environment tag. New resources that do not meet the rule must be blocked, and existing noncompliant resources should appear in compliance reports. What should be configured?

Accepted Answer

An Azure Policy assignment at the subscription scope with a deny effect.. Azure Policy with a deny effect at the subscription scope is the correct choice because it enforces a rule that blocks the creation or update of any resource that does not include the required 'Environment' tag. The deny effect actively prevents noncompliant deployments, while the policy itself evaluates existing resources and marks them as noncompliant in compliance reports, meeting both requirements.

Answer

A Contributor role assignment at the subscription scope.

Answer

A resource lock on the subscription.

Answer

A custom RBAC role that includes tag write permissions.