AZ-104 Manage Azure Identities and Governance Practice Test 4 — 15 Questions

Question 1

You need to ensure that a contractor can manage virtual machines only in the RG-Test resource group and cannot access any other resource groups in the subscription. What is the best way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Test scope. Assigning the Virtual Machine Contributor role at the RG-Test scope grants the contractor permissions to manage virtual machines within that specific resource group only, adhering to the principle of least privilege. This role includes actions like creating, starting, stopping, and deleting VMs, but does not allow access to other resource groups in the subscription because the role assignment is scoped to RG-Test.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-Test scope

Answer

Assign the Owner role at the RG-Test scope

Question 2

You need to ensure that junior administrators can view all resources in the Prod-Sub subscription but cannot create, modify, or delete any resources. Which Azure RBAC role should you assign?

Accepted Answer

Reader. The Reader role is the correct choice because it grants read-only access to all resources in a subscription, including their properties and status, but does not allow any create, modify, or delete operations. This aligns perfectly with the requirement for junior administrators to view resources without making changes.

Answer

Owner

Answer

Contributor

Answer

Monitoring Reader

Question 3

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents the resource group from being deleted while still allowing all operations (including create and modify) on resources within it. This is the correct choice because the requirement is specifically to block deletion, not to restrict modifications or read access.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 4

Your organization wants all subscriptions under the Corp-MG management group to inherit a policy that blocks deployment of resource types not on an approved list. Which Azure feature should you use?

Accepted Answer

Azure Policy assigned at the management group scope. Azure Policy assigned at the management group scope is the correct choice because it allows you to enforce governance rules across all subscriptions within a management group hierarchy. By creating a policy definition that blocks deployment of resource types not on an approved list and assigning it to the Corp-MG management group, the policy will be inherited by all child subscriptions, ensuring consistent compliance without manual configuration per subscription.

Answer

A custom RBAC role assigned at the tenant root

Answer

A ReadOnly lock on each subscription

Answer

A budget alert for each subscription

Question 5

You need to ensure that administrators cannot accidentally delete a production virtual network, but they must still be able to update subnet settings. Which Azure feature should you apply?

Accepted Answer

A CanNotDelete lock. A CanNotDelete lock (Azure resource lock) prevents accidental deletion of the virtual network while allowing all other operations, including updates to subnet settings. This lock type blocks DELETE requests at the Azure Resource Manager level, but permits PUT and PATCH operations, so administrators can still modify subnet configurations.

Answer

A ReadOnly lock

Answer

An Azure Policy deny assignment

Answer

A budget alert

Question 6

You need to allow a support engineer to restart virtual machines in the RG-App resource group, but the engineer must not be able to create, delete, or resize the virtual machines. What should you do?

Accepted Answer

Create a custom role that includes restart permissions and assign it at the RG-App scope. The Virtual Machine Contributor role includes permissions to restart VMs but also allows creating, deleting, and resizing VMs, which violates the requirement. A custom role with only the Microsoft.Compute/virtualMachines/restart/action permission assigned at the RG-App scope grants the exact restart capability without broader management rights.

Answer

Assign the Virtual Machine Contributor role at the RG-App scope

Answer

Assign the Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-App scope

Question 7

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which Azure lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while still allowing all operations (read, write, modify) on resources within it. This lock type is designed specifically to protect against accidental deletion without restricting administrative actions like creating or updating resources.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 8

You need to ensure that a finance analyst can view all resources in the Finance-Sub subscription and also view spending details, but cannot create, modify, or delete any resources. Which built-in Azure RBAC role should you assign?

Accepted Answer

Reader. The Reader role is the correct choice because it provides read-only access to all resources in a subscription, including the ability to view resource properties and deployment history, but it does not allow any create, modify, or delete operations. Additionally, the Reader role includes the 'Microsoft.CostManagement/views/read' permission, which enables viewing spending details (cost data) in the Azure portal. This aligns exactly with the requirement to view resources and spending without making changes.

Answer

Owner

Answer

Contributor

Answer

Virtual Machine Contributor

Question 9

Your company wants every subscription under the Corp-MG management group to block the creation of resource groups unless the deployment includes the tags CostCenter and Environment. You need a centralized solution that is inherited by child subscriptions. What should you configure?

Accepted Answer

An Azure Policy assignment at the management group scope. Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.

Answer

A custom RBAC role at the tenant root

Answer

A CanNotDelete lock on each subscription

Answer

A subscription budget alert

Question 10

An Azure application and an Azure Automation account need Azure access without any stored secrets. The same identity should be reusable and should not require manual secret rotation. Which two identity choices meet the requirement? Select two.

Accepted Answer

System-assigned managed identity attached to the resource that needs access.. System-assigned managed identity (Option A) is correct because it is automatically created and tied to a specific Azure resource, such as a virtual machine or App Service, and provides an Microsoft Entra ID identity that can be used to authenticate to any service supporting Microsoft Entra ID authentication without storing any secrets. The identity is managed by Azure, eliminating the need for manual secret rotation, and it is automatically deleted when the resource is deleted, ensuring no orphaned secrets.

Answer

Service principal with a client secret stored in an app setting.

Answer

Shared administrator username and password stored in a Key Vault secret.

Answer

SAS token generated once and reused indefinitely by both resources.

Question 11

You need to ensure engineers cannot delete a production resource group, but they must still be able to start and stop VMs and change network rules during maintenance. Which resource lock should you apply to the resource group?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while allowing all other operations, including starting/stopping VMs and modifying network rules. This meets the requirement because engineers retain full management capabilities except for deletion, which is explicitly blocked at the resource group scope.

Answer

No lock

Answer

ReadOnly

Answer

Azure Policy deny assignment

Question 12

An administrator added a user to an Entra security group that already has Contributor on a resource group. The role assignment is correct, but the user still gets 'You do not have access' in the Azure portal 5 minutes later. What is the most likely next step?

Accepted Answer

Have the user sign out and sign back in to refresh the access token.. When a user is added to a security group that already has a role assignment, the new permissions take effect immediately in Azure RBAC, but the user's existing access token (which is cached by the Azure portal) does not include the new group membership claims. The token must be refreshed by signing out and signing back in, or by closing and reopening the browser, to force a new token acquisition that includes the updated role assignments.

Answer

Change the role assignment from the group to the subscription.

Answer

Delete and recreate the resource group.

Answer

Assign Owner directly to the user.

Question 13

A user had a direct Reader assignment on a virtual machine, but that assignment was removed. The user can still open the VM blade and view its properties. Which two sources could still be granting access? Select two.

Accepted Answer

A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.. Azure RBAC permissions are inherited from higher scopes. Even if a direct Reader assignment on the VM is removed, a Reader role assigned at the parent resource group, subscription, or management group scope will still grant the user read access to the VM through inheritance. This is a fundamental behavior of Azure RBAC, where permissions flow down the hierarchy.

Answer

A CanNotDelete lock on the VM is granting the user permission to view it.

Answer

An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.

Answer

A private endpoint connected to the VM subnet is providing inherited read permission through networking.

Question 14

A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?

Accepted Answer

The vm-app01 virtual machine resource itself.. Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.

Answer

The entire subscription that contains vm-app01.

Answer

The resource group that contains vm-app01.

Answer

The management group that contains the subscription.

Question 15

An enterprise wants one governance package to be applied automatically to every production subscription that is added in the future. The package contains several policy definitions that should be managed together. Which two actions are required? Select two.

Accepted Answer

Create or use a production management group and assign the governance package at that scope.. Assigning the governance package (policy initiative) at the management group scope ensures that all child subscriptions, including future ones, automatically inherit the policies. Management groups provide hierarchical governance, and any subscription added under that management group will inherit the assigned policies without manual intervention.

Answer

Assign each policy separately to every resource group so the settings are inherited upward.

Answer

Use tags on resources to make policy definitions automatically apply to new subscriptions.

Answer

Apply a resource lock to the management group so all child subscriptions inherit the policies.