AZ-104 Manage Azure Identities and Governance Practice Test 2 — 15 Questions

Question 1

A team needs Reader access to exactly two Azure resources that are in the same resource group, and they must not gain access to other resources in that group. Which two scope choices are appropriate? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the role at the storage account scope.. Assigning the Reader role at the storage account scope (Option A) grants read-only access only to that storage account, not to other resources in the resource group. Similarly, assigning the Reader role at the Key Vault scope (Option B) grants read-only access only to that Key Vault. Together, these two assignments provide access to exactly the two specified resources without granting access to any other resource in the group. Options C, D, and E would grant access to all resources within the resource group, subscription, or management group, respectively, which does not meet the requirement.

Answer

Assign the role at the resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 2

A project team adds and removes contractors every month. The team wants Azure role assignments to stay the same when individual contractors leave or join, and access should be granted to everyone on the team through one control point. What should the administrator assign the Azure role to?

Accepted Answer

A Microsoft Entra security group. Assigning an Azure role to a Microsoft Entra security group provides a single control point for managing permissions. When contractors join or leave, the administrator only needs to add or remove their user accounts from the group, and the role assignments remain intact. This decouples access from individual user accounts and ensures consistent permissions for the entire team.

Answer

A Microsoft 365 group

Answer

A guest user account

Answer

A managed identity

Question 3

A central audit group must have Reader access for every current and future subscription in the company hierarchy. You want one assignment that will apply broadly as new subscriptions are added. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions. The explanation correctly identifies management group assignment as the right scope. However, the exam trap falsely claims Azure does not support role assignments at tenant root scope; in fact, the tenant root is a management group and supports RBAC assignments, though it may require elevated access.

Answer

At one resource group in each subscription

Answer

At a single resource

Answer

At the tenant root only for one application

Question 4

Based on the exhibit, which lock should the administrator apply to protect the resource group from accidental deletion while still allowing normal updates to the resources inside it?

Accepted Answer

Apply a CanNotDelete lock to rg-payroll-prod.. The CanNotDelete lock (also known as Delete lock) prevents the resource group itself from being deleted while still allowing all updates (including create, modify, and delete operations) on the resources within it. This is the correct choice because the requirement is to protect only the resource group from accidental deletion, not to restrict changes to the resources inside.

Answer

Apply a ReadOnly lock to rg-payroll-prod.

Answer

Apply a tag named Protected=True to rg-payroll-prod.

Answer

Create an Azure Policy assignment that denies all delete operations.

Question 5

An Azure Policy that appends the Environment tag is assigned to a subscription. New virtual machines get the tag, but existing VMs do not. What should the administrator do next?

Accepted Answer

Create a remediation task for the policy assignment. Append effect policies apply only when resources are created or updated and do not support remediation tasks. Remediation tasks are supported only for modify and deployIfNotExists effects. Therefore, creating a remediation task for an append policy is not valid, and none of the listed options is correct. To bring existing VMs into compliance, either replace the policy with a modify or deployIfNotExists effect and then create a remediation task, or manually tag the VMs.

Answer

Remove the policy and reassign it at the resource group scope

Answer

Grant the policy assignment Reader access

Answer

Apply a CanNotDelete lock to the subscription

Question 6

A VM-hosted app needs to upload blobs without storing a storage account key or password on the VM. Which two authentication options meet this requirement? Select two.

Accepted Answer

System-assigned managed identity. System-assigned managed identity (Option A) is correct because it allows the VM to authenticate to Azure Blob Storage without storing any credentials on the VM. When enabled, Azure automatically creates a service principal in Azure AD for the VM, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to storage. Similarly, user-assigned managed identity (Option B) is also correct: it creates a standalone managed identity that can be assigned to the VM, and the VM uses that identity to obtain an Azure AD token, again without storing any key or password on the VM. Both eliminate stored credentials on the VM.

Answer

Storage account access key in an application setting

Answer

Shared access signature token saved on the VM

Answer

Anonymous public access to the container

Question 7

An enterprise has a management group named Corp that contains all production and sandbox subscriptions. An Entra ID group named Auditors must be able to read resources in every current subscription under Corp and in any subscription added later. Which two actions should the administrator take? Select two.

Accepted Answer

Assign the Reader role to the Auditors group at the Corp management group scope.. Assigning the Reader role to the Auditors group at the Corp management group scope ensures that the group receives read permissions to all current and future subscriptions and resource groups under Corp, because Azure RBAC permissions assigned at a management group are inherited by all child scopes. This satisfies the requirement for both existing and future subscriptions without manual updates. In addition, the intended users must be added as members of the Auditors Entra ID group, because the role assignment grants permissions to the group, not to individual users. Therefore, both actions are necessary: the role assignment at the correct scope and populating the group with the auditors.

Answer

Assign the Reader role directly to every subscription under Corp.

Answer

Assign the Reader role to the Auditors group at one resource group scope.

Answer

Create an Azure Policy assignment to grant read access to all subscriptions.

Question 8

A security team wants operators in one resource group to start, stop, and restart virtual machines, but they must not create VMs, delete VMs, or manage disks and networking. What should the administrator configure?

Accepted Answer

Create a custom RBAC role with only the VM power actions and assign it at the resource group scope.. The built-in Contributor role grants full management access. The Virtual Machine Contributor role allows managing VMs (including creating and deleting VMs) and managing disks, but does not allow creating or managing network resources. However, because VM Contributor still allows creating/deleting VMs and managing disks, it violates the requirement. A custom RBAC role that includes only the specific VM power actions (and read access) meets the least-privilege requirement exactly.

Answer

Assign the Contributor role at the resource group scope.

Answer

Assign the Virtual Machine Contributor role at the resource group scope.

Answer

Use Azure Policy to deny creation of new VMs in the resource group.

Question 9

A production resource group must be protected from accidental deletion during a change freeze. Administrators still need to update VM sizes, rotate tags, and change NSG rules. Which action should the administrator take?

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Applying a CanNotDelete lock to the resource group is the correct action. It prevents deletion of the resource group and all current and future resources while allowing read/write operations. ReadOnly locks would block updates, and Azure Policy or tags cannot provide the same built-in deletion protection.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Apply a CanNotDelete lock to each individual resource in the resource group.

Answer

Use Azure Policy to deny all delete requests.

Answer

Add a Protected=true tag and use it to prevent deletion.

Question 10

Based on the exhibit, a subscription policy must add CostCenter=042 to new resources, and deployments must not fail if the tag is missing. Which policy effect should you use?

Accepted Answer

Modify. The 'Modify' effect (option D) is correct because it can add the CostCenter=042 tag to new resources without causing deployment failures if the tag is missing. Unlike 'Deny', which blocks non-compliant resources, or 'Append', which is deprecated and only works on non-tag properties, 'Modify' uses a 'merge' operation to add tags during resource creation or update, and its 'conflictEffect' can be set to 'audit' to ensure deployments succeed even when the tag is absent.

Answer

Deny

Answer

Audit

Answer

Append

Question 11

You are an Azure administrator for a company that is planning to implement a new Azure environment. The company has the following requirements:
- Users must be able to sign in using their on-premises Active Directory credentials.
- Multi-factor authentication (MFA) must be enforced for all administrative users.
- Access to Azure resources must be controlled using role-based access control (RBAC) with custom roles.
- Audit logs must be retained for a minimum of three years.
Which four of the following solutions should you implement to meet these requirements? Choose all that apply. (There are four correct answers.)

Accepted Answer

Configure Azure AD Conditional Access policy to require MFA for all users in the Global Administrator role.. To meet the requirements: (1) Deploy Azure AD Connect to sync identities, enabling on-prem credentials for sign-in. (2) Create custom RBAC roles in Azure Resource Manager to control access to Azure resources. (3) Configure diagnostic settings for Azure AD audit logs to send to Log Analytics with 1095-day retention to meet the 3-year retention requirement. (4) For MFA, you must enforce it for all administrative roles, not just Global Administrators. A Conditional Access policy that only includes the Global Administrator role is insufficient. Therefore, the correct options are A, C, and E. Option F is incorrect. Options B and D are also incorrect.

Answer

Configure Azure AD Privileged Identity Management (PIM) to require approval for role activation.

Answer

Create a custom RBAC role in Azure AD to control access to Azure resources.

Question 12

Your company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?

Accepted Answer

Assign the custom role to VMOperators at the RG-Prod scope.. Assigning the custom role at the RG-Prod scope restricts the role's permissions to only the virtual machines within that specific resource group. This meets the requirement that VMOperators can restart VMs but not create, delete, or resize them, and only within RG-Prod.

Answer

Assign the custom role to VMOperators at the subscription scope.

Answer

Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.

Answer

Assign the custom role to VMOperators at the management group scope.

Question 13

Your organization assigns an Azure Policy at the Corp-MG management group to require the tag Environment on all newly created resources. A deployment to RG-App in the Prod-Sub subscription fails because the tag is missing. You need to allow this single deployment to proceed without weakening enforcement for the rest of the organization. What should you do?

Accepted Answer

Create a policy exemption at the Prod-Sub or RG-App scope.. A policy exemption allows you to exclude a specific scope (like Prod-Sub or RG-App) from the enforcement of a policy assignment without modifying or removing the policy itself. This lets the single deployment proceed while maintaining the Deny effect for all other resources under Corp-MG. Exemptions can be created with an expiration date to ensure temporary relief does not become permanent.

Answer

Remove the policy assignment from Corp-MG.

Answer

Change the policy effect from Deny to Audit for all assignments.

Answer

Move Prod-Sub out of Corp-MG.

Question 14

You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?

Accepted Answer

A Microsoft Entra group and a single role assignment to the group.. Assigning a single RBAC role to a Microsoft Entra group allows you to manage permissions centrally. When membership changes, you only need to add or remove users from the group, and the role assignment automatically applies to the new members. This minimizes ongoing administrative effort compared to managing individual role assignments.

Answer

A separate custom role assignment for each administrator.

Answer

A resource lock on every virtual machine.

Answer

A policy exemption for the administrators.

Question 15

A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?

Accepted Answer

A CanNotDelete lock on stfinance01.. A CanNotDelete lock on stfinance01 prevents the storage account from being deleted while still allowing administrators to read and modify data. This lock type blocks delete operations at the resource level, but does not restrict read or write access, which is exactly what the requirement specifies.

Answer

A ReadOnly lock on stfinance01.

Answer

A policy assignment that audits storage accounts.

Answer

An NSG rule denying outbound traffic from the subnet.