AZ-104 Manage Azure Identities and Governance Practice Test 3 — 15 Questions

Question 1

A support engineer must start and restart one specific virtual machine from the Azure portal, but must not be able to delete the VM, change networking, or grant access to others. Which two actions should be included in a custom role? Select two.

Accepted Answer

Microsoft.Compute/virtualMachines/start/action grants the ability to start the VM without broader management permissions.. Option A is correct because Microsoft.Compute/virtualMachines/start/action is a specific permission that allows starting a VM without granting broader management capabilities like deletion or network changes. This action is part of the Azure RBAC role definition and can be included in a custom role to limit the support engineer's scope to only starting the VM.

Answer

Microsoft.Compute/virtualMachines/delete gives the ability to remove the VM from the subscription.

Answer

Microsoft.Network/networkInterfaces/write is needed because a VM start or restart always requires NIC modification rights.

Answer

Microsoft.Authorization/roleAssignments/write would let the engineer grant access to other users and manage permissions.

Question 2

A storage automation service principal must upload, read, and delete blob data in one container by using Microsoft Entra authentication. It must not manage storage account settings, keys, or other containers. Which approach is best?

Accepted Answer

Create a custom role with blob dataActions only and assign it at the container scope.. Option B is correct because it creates a custom Azure RBAC role with only the required blob data actions (e.g., Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read, write, delete) and assigns it at the container scope. This ensures the service principal can upload, read, and delete blobs in that specific container using Microsoft Entra authentication, without any permissions to manage storage account settings, keys, or other containers.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Assign Reader and give the service principal a storage account access key.

Answer

Assign Contributor at the subscription scope and restrict access with naming conventions.

Question 3

A user had a direct Reader assignment on a virtual machine, but that assignment was removed. The user can still open the VM blade and view its properties. Which two sources could still be granting access? Select two.

Accepted Answer

A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.. Option A is correct because Azure RBAC permissions are inherited from higher scopes. Even if a direct Reader assignment on the VM is removed, a Reader role assigned at the parent resource group, subscription, or management group scope will still grant the user read access to the VM through inheritance. This is a fundamental behavior of Azure RBAC, where permissions flow down the hierarchy.

Answer

A CanNotDelete lock on the VM is granting the user permission to view it.

Answer

An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.

Answer

A private endpoint connected to the VM subnet is providing inherited read permission through networking.

Question 4

A resource group has a ReadOnly lock applied to it. An operator can view the resources, but several portal changes fail. Which two operations will fail because of the lock? Select two.

Accepted Answer

Changing the size of an existing virtual machine in the resource group will fail because it is a write operation.. A is correct because changing the size of an existing virtual machine is a write operation that modifies the VM's configuration. A ReadOnly lock on the resource group prevents all write and delete operations, so any attempt to resize the VM will fail. The lock does not affect read operations, which remain functional.

Answer

Reading the resource group's activity log will fail because lock-protected scopes cannot be queried.

Answer

Listing the resources in the resource group with Azure CLI will fail because enumeration is a write operation.

Answer

Fetching the current VM configuration from the ARM API will fail because reads are denied by the lock.

Question 5

A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?

Accepted Answer

The vm-app01 virtual machine resource itself.. Option C is correct because Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.

Answer

The entire subscription that contains vm-app01.

Answer

The resource group that contains vm-app01.

Answer

The management group that contains the subscription.

Question 6

An enterprise wants one governance package to be applied automatically to every production subscription that is added in the future. The package contains several policy definitions that should be managed together. Which two actions are required? Select two.

Accepted Answer

Create or use a production management group and assign the governance package at that scope.. Option A is correct because assigning the governance package (policy initiative) at the management group scope ensures that all child subscriptions, including future ones, automatically inherit the policies. Management groups provide hierarchical governance, and any subscription added under that management group will inherit the assigned policies without manual intervention.

Answer

Assign each policy separately to every resource group so the settings are inherited upward.

Answer

Use tags on resources to make policy definitions automatically apply to new subscriptions.

Answer

Apply a resource lock to the management group so all child subscriptions inherit the policies.

Question 7

Your company has separate subscriptions for development, test, and production. Security wants one baseline policy and one RBAC assignment to apply automatically to every production subscription now and in the future. What should you use?

Accepted Answer

A management group above the production subscriptions.. B is correct because management groups allow you to apply Azure Policy and RBAC assignments hierarchically. By placing all production subscriptions under a single management group, any policy or role assignment at that level will be inherited by every current and future production subscription, meeting the requirement for automatic application without manual intervention.

Answer

A resource group that contains all production resources.

Answer

A tag applied to each production resource.

Answer

A single production subscription with multiple resource groups.

Question 8

A developer has the Contributor role on a subscription. Their ARM deployment of a virtual machine with a public IP fails, and the error message says the request is denied by policy. The developer can create other resources successfully. What should you change to allow this deployment while keeping the Contributor role unchanged?

Accepted Answer

Modify or exempt the Azure Policy assignment that blocks public IP addresses.. The error indicates that an Azure Policy is denying the deployment of a virtual machine with a public IP address. Since the developer has the Contributor role, they have sufficient permissions to create resources, but Azure Policy overrides permissions by enforcing rules. Modifying or creating an exemption for the specific policy that blocks public IP addresses will allow the deployment without changing the developer's role.

Answer

Assign the developer the Owner role on the subscription.

Answer

Remove any lock from the virtual machine's resource group.

Answer

Move the virtual machine to another management group.

Question 9

A developer has the Contributor role on a resource group and tries to deploy a Windows VM with a public IP address. The deployment fails, even though the role assignment is active. Which two checks should you perform first to confirm why the deployment failed? Select two.

Accepted Answer

Review Azure Policy assignments at the subscription or management group for deny or modify effects on public IP resources.. Option A is correct because Azure Policy can override role-based permissions. Even though the developer has the Contributor role, a policy with a 'deny' or 'modify' effect on public IP resources at the subscription or management group scope can block the deployment of a VM with a public IP address. Policies are evaluated before RBAC, so this is a primary check.

Answer

Check for a CanNotDelete lock on the resource group because that lock blocks all deployments.

Answer

Confirm that the VM size is available in the region because size availability is the most common authorization issue.

Answer

Inspect whether tags are inherited from the subscription because tag inheritance can deny a deployment request.

Question 10

An Azure Automation account runs PowerShell runbooks that must authenticate to Azure resources without embedded secrets. The automation account is recreated periodically during deployment, and the identity must continue to work after recreation without reissuing credentials. Which identity should you use?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity (B) is the correct choice because it is an independent Azure resource that persists even when the Automation account is recreated. Unlike a system-assigned managed identity, which is tied to the lifecycle of the Automation account and is deleted when the account is deleted, a user-assigned managed identity can be reassigned to the new Automation account after recreation without requiring new credentials. This allows the runbooks to authenticate seamlessly using the same identity, avoiding embedded secrets.

Answer

A system-assigned managed identity.

Answer

A service principal with a client secret stored in Key Vault.

Answer

A shared access signature token.

Question 11

Your company wants one governance baseline to apply automatically to all current and future production subscriptions, and finance wants cost reporting by application across many resource groups. Which two design choices best satisfy the requirements? Select two.

Accepted Answer

Place the production subscriptions under a dedicated management group so inherited policy and RBAC can be applied once.. Option A is correct because placing production subscriptions under a dedicated management group allows you to apply Azure Policy and Azure RBAC at the management group scope, which automatically inherits to all current and future subscriptions within that hierarchy. This ensures a consistent governance baseline without manual intervention for new subscriptions.

Answer

Place all production workloads into one shared resource group so governance and reporting are simpler.

Answer

Use management groups instead of tags because tags are not useful for cost reporting.

Answer

Assign the baseline only at one subscription and copy the settings manually to every new subscription.

Question 12

A contractor is a member of an Entra security group that has a PIM-eligible Contributor assignment on a resource group. The contractor sees the role in the portal, but deployment fails with a role not active message. The activation policy requires justification, MFA, and manager approval. Which two actions are required before the deployment succeeds? Select two.

Accepted Answer

Activate the eligible role assignment in Privileged Identity Management.. Option A is correct because the contractor has a PIM-eligible role assignment, which means the role is not active until the user activates it through Privileged Identity Management. Activation is a prerequisite for the role to be effective, and without it, any deployment requiring the Contributor role will fail with a 'role not active' message.

Answer

Add the contractor directly to the subscription Owner role to bypass the eligibility workflow.

Answer

Wait for Azure Policy compliance evaluation to finish before trying again.

Answer

Remove the user from the security group and add them back so the role becomes active.

Question 13

Your company has multiple applications deployed across separate production and nonproduction subscriptions. Finance wants cost reporting by application, and each app team should manage only its own resources. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Place each application's Azure resources in a dedicated resource group.. Option A is correct because resource groups are the logical container for grouping Azure resources by application, enabling each app team to manage its own resources via Azure RBAC at the resource group scope. Option B is correct because tagging resources with an application or cost-center identifier allows Azure Cost Management to filter and report costs by application, satisfying the finance requirement for cost reporting by application.

Answer

Create one subscription per virtual machine to simplify chargeback reporting.

Answer

Use resource names only for cost reporting because names are always unique and queryable.

Answer

Place all applications in one management group and use it as the access boundary for each app team.

Question 14

An Azure Automation account is recreated periodically during a migration project. Runbooks must authenticate to Azure resources without embedded secrets, and the identity must continue to work after the account is rebuilt. Which two choices should you make? Select two.

Accepted Answer

Use a user-assigned managed identity so the identity is independent of the Automation account lifecycle.. Option A is correct because a user-assigned managed identity exists as a standalone Azure resource independent of the Automation account's lifecycle. When the Automation account is recreated, you can reassign the same user-assigned managed identity to the new account, preserving the identity's object ID and its RBAC role assignments. This ensures that runbooks can authenticate without embedded secrets and continue to work seamlessly after the account is rebuilt.

Answer

Use a service principal with a client secret stored in an encrypted Automation variable.

Answer

Use a system-assigned managed identity attached to the Automation account because it is always reusable after recreation.

Answer

Store a storage account key in a runbook asset and retrieve it at runtime.

Question 15

A contractor is a member of an Entra security group that has the Contributor role on a resource group. When the contractor tries to deploy, the portal says the role is not active. The activation request requires approver approval, and the previous activation window has expired. What should the contractor do?

Accepted Answer

Activate the eligible role through Privileged Identity Management and obtain approval if required.. The contractor has an eligible role assignment that requires activation through Privileged Identity Management (PIM). Since the previous activation window has expired, the role is no longer active, and the contractor must initiate a new activation request, which may require approver approval. Option D correctly describes this process, as PIM is the Azure service designed for just-in-time access to privileged roles.

Answer

Wait for the role assignment to propagate to Azure.

Answer

Create a new security group and assign Contributor directly.

Answer

Sign out of the portal and sign back in only.