AZ-104 Manage Azure Identities and Governance Practice Test 3 — 15 Questions

Question 1

You have an Azure subscription that contains a virtual network named VNet1. You need to delegate management of VNet1 to a partner company. The partner company's administrators must be able to create and manage subnets in VNet1, but they must not be able to modify the address space of VNet1 or access any other resources in the subscription. You invite the partner's users as guest users in your Azure AD tenant. What should you do next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom role that allows Microsoft.Network/virtualNetworks/subnets/* and assign it to the partner users at the VNet1 scope.. To delegate management of subnets in a specific virtual network while preventing changes to the virtual network's address space, you need a custom role with actions limited to subnets. Assigning this role at the VNet1 scope ensures the partner can only manage subnets within VNet1 and cannot affect other resources or the VNet's core properties. Built-in roles like Network Contributor or Contributor grant broader permissions.

Answer

Assign the Network Contributor role to the partner users at the VNet1 scope.

Answer

Create a custom role that allows Microsoft.Network/virtualNetworks/subnets/read and Microsoft.Network/virtualNetworks/subnets/write, and assign it to the partner users at the subscription scope.

Answer

Assign the Contributor role to the partner users at the VNet1 scope.

Question 2

Your company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?

Accepted Answer

Assign the custom role to VMOperators at the RG-Prod scope.. Assigning the custom role at the RG-Prod scope restricts the role's permissions to only the virtual machines within that specific resource group. This meets the requirement that VMOperators can restart VMs but not create, delete, or resize them, and only within RG-Prod.

Answer

Assign the custom role to VMOperators at the subscription scope.

Answer

Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.

Answer

Assign the custom role to VMOperators at the management group scope.

Question 3

Your organization assigns an Azure Policy at the Corp-MG management group to require the tag Environment on all newly created resources. A deployment to RG-App in the Prod-Sub subscription fails because the tag is missing. You need to allow this single deployment to proceed without weakening enforcement for the rest of the organization. What should you do?

Accepted Answer

Create a policy exemption at the Prod-Sub or RG-App scope.. A policy exemption allows you to exclude a specific scope (like Prod-Sub or RG-App) from the enforcement of a policy assignment without modifying or removing the policy itself. This lets the single deployment proceed while maintaining the Deny effect for all other resources under Corp-MG. Exemptions can be created with an expiration date to ensure temporary relief does not become permanent.

Answer

Remove the policy assignment from Corp-MG.

Answer

Change the policy effect from Deny to Audit for all assignments.

Answer

Move Prod-Sub out of Corp-MG.

Question 4

You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?

Accepted Answer

A Microsoft Entra group and a single role assignment to the group.. Assigning a single RBAC role to a Microsoft Entra group allows you to manage permissions centrally. When membership changes, you only need to add or remove users from the group, and the role assignment automatically applies to the new members. This minimizes ongoing administrative effort compared to managing individual role assignments.

Answer

A separate custom role assignment for each administrator.

Answer

A resource lock on every virtual machine.

Answer

A policy exemption for the administrators.

Question 5

A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?

Accepted Answer

A CanNotDelete lock on stfinance01.. A CanNotDelete lock on stfinance01 prevents the storage account from being deleted while still allowing administrators to read and modify data. This lock type blocks delete operations at the resource level, but does not restrict read or write access, which is exactly what the requirement specifies.

Answer

A ReadOnly lock on stfinance01.

Answer

A policy assignment that audits storage accounts.

Answer

An NSG rule denying outbound traffic from the subnet.

Question 6

Your company has two subscriptions named Dev-Sub and Prod-Sub. A new administrator must be able to create resource groups only in Dev-Sub and must not have any permissions in Prod-Sub. What should you do?

Accepted Answer

Assign Contributor to the administrator at the Dev-Sub scope.. Assigning the Contributor role at the Dev-Sub scope grants the administrator full permissions to create and manage resource groups within that subscription, while the role assignment is scoped exclusively to Dev-Sub, ensuring no permissions in Prod-Sub. Azure RBAC is hierarchical, so a role assigned at a subscription scope applies to all resource groups within it, but does not cross subscription boundaries. This meets the requirement of allowing resource group creation only in Dev-Sub with no access to Prod-Sub.

Answer

Assign Contributor to the administrator at the management group scope.

Answer

Assign Owner to the administrator at the resource group scope in Dev-Sub.

Answer

Assign Reader to the administrator at the Prod-Sub scope and Contributor at the tenant root group.

Question 7

Your organization requires all storage accounts to allow access only from selected networks. You need a governance solution that automatically corrects noncompliant new storage accounts when possible instead of only reporting them. What policy effect should you choose?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists policy effect is correct because it can automatically remediate noncompliant storage accounts by deploying a network rules configuration that restricts access to selected networks. Unlike Audit, which only reports compliance status, DeployIfNotExists actively modifies the resource to meet the policy requirement when possible, aligning with the need for automatic correction.

Answer

Audit

Answer

Disabled

Answer

Append

Question 8

You need to prevent accidental deletion of a production resource group while still allowing administrators to update resources inside it. What should you apply to the resource group?

Accepted Answer

A CanNotDelete lock. A CanNotDelete lock (B) prevents the resource group from being deleted while still allowing all operations (including updates) on resources within it. This is the correct choice because the requirement is to block accidental deletion of the entire resource group, not to restrict modifications to its resources.

Answer

A ReadOnly lock

Answer

A deny assignment

Answer

A budget alert

Question 9

Your company has two Azure subscriptions named Dev-Sub and Prod-Sub. You need to ensure that a user can create resource groups only in Dev-Sub and nowhere else. What should you do?

Accepted Answer

Assign the Contributor role at the Dev-Sub subscription scope.. The Contributor role allows a user to create and manage resources, including resource groups, within the assigned scope. By assigning this role at the Dev-Sub subscription scope, the user gains the necessary permissions to create resource groups only in that subscription, as Azure RBAC permissions are inherited downward but not across sibling scopes. This ensures the user cannot create resource groups in Prod-Sub or any other subscription.

Answer

Assign the Owner role at the tenant root scope.

Answer

Assign the Reader role at the Dev-Sub subscription scope.

Answer

Assign the Contributor role at the management group scope that contains both subscriptions.

Question 10

You need to ensure that all new resources deployed to a subscription automatically receive a CostCenter tag with a default value if the tag is omitted during deployment. Which Azure governance feature should you use?

Accepted Answer

An Azure Policy with an append or modify effect. Azure Policy with an append or modify effect can automatically add a CostCenter tag with a default value to resources that are missing it during deployment. The append effect adds the tag and value at creation time, while the modify effect (using a 'addOrReplace' operation) can also update existing resources. This ensures governance compliance without manual intervention.

Answer

A resource lock

Answer

A management group lock

Answer

A custom RBAC role

Question 11

You need to ensure that all users in the HelpdeskAdmins group can reset passwords for cloud-only users in Microsoft Entra ID but cannot modify group memberships or delete users. Which role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets for non-administrator users (including cloud-only users) while explicitly preventing modifications to group memberships or deletion of users. This aligns perfectly with the requirement to restrict the HelpdeskAdmins group to only password reset capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Security Administrator

Question 12

You need to ensure that all newly created resource groups in a subscription automatically inherit the CostCenter tag with a fixed value, even if the creator forgets to add it. Which Azure Policy effect should you use?

Accepted Answer

Modify. The Modify effect is correct because it allows Azure Policy to automatically add or alter tags on resources or resource groups during creation or update, ensuring the CostCenter tag with a fixed value is applied even if the creator omits it. Unlike Audit or Deny, Modify actively remediates non-compliant resources by appending the required tag, making it ideal for enforcing mandatory inheritance without blocking deployment.

Answer

Audit

Answer

Deny

Answer

Disabled

Question 13

Your company uses Microsoft Entra ID. A new engineer must be able to create virtual machines in RG-Dev but must not be able to assign roles to other users. Which built-in role should you assign at the RG-Dev scope?

Accepted Answer

Virtual Machine Contributor. The Virtual Machine Contributor role provides the exact permissions needed: it allows creating and managing virtual machines within the specified scope (RG-Dev), but explicitly does not include the ability to assign roles to other users. This role grants write access to compute resources while preserving the principle of least privilege.

Answer

Owner

Answer

User Access Administrator

Answer

Reader

Question 14

An Azure subscription contains several resource groups. You need to ensure that users can create virtual machines only in regions approved by the security team. Existing noncompliant VMs can remain unchanged. What should you do?

Accepted Answer

Assign a policy that denies resources in disallowed locations.. Azure Policy can enforce organizational standards by evaluating resources for compliance. The built-in 'Not allowed locations' policy denies the creation of resources in specified regions, ensuring users can only deploy VMs in approved regions. Since the requirement is to allow existing noncompliant VMs to remain unchanged, a deny effect policy (without a 'DeployIfNotExists' or 'Modify' effect) will only affect new deployments, leaving existing resources untouched.

Answer

Apply a ReadOnly lock to each resource group.

Answer

Create an action group in Azure Monitor.

Answer

Move all existing VMs to approved regions.

Question 15

Your company wants to enforce a standard list of allowed Azure regions for all new resource deployments across several subscriptions. You need a centralized governance solution that can be assigned once and inherited by the child subscriptions. What should you use?

Accepted Answer

An Azure Policy assigned at the management group scope. Azure Policy assigned at the management group scope is the correct centralized governance solution because it enforces a standard list of allowed Azure regions across all subscriptions under that management group. Policies at the management group level are inherited by all child subscriptions, ensuring consistent compliance without requiring individual assignment per subscription.

Answer

A custom RBAC role assigned at each subscription

Answer

A CanNotDelete lock on each subscription

Answer

A budget alert on each subscription