AZ-104 Manage Azure Identities and Governance Practice Test 4 — 15 Questions

Question 1

You need to allow a support engineer to restart virtual machines in the RG-App resource group, but the engineer must not be able to create, delete, or resize the virtual machines. What should you do?

Accepted Answer

Create a custom role that includes restart permissions and assign it at the RG-App scope. The Virtual Machine Contributor role includes permissions to restart VMs but also allows creating, deleting, and resizing VMs, which violates the requirement. A custom role with only the Microsoft.Compute/virtualMachines/restart/action permission assigned at the RG-App scope grants the exact restart capability without broader management rights.

Answer

Assign the Virtual Machine Contributor role at the RG-App scope

Answer

Assign the Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-App scope

Question 2

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which Azure lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while still allowing all operations (read, write, modify) on resources within it. This lock type is designed specifically to protect against accidental deletion without restricting administrative actions like creating or updating resources.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 3

You need to ensure that a finance analyst can view all resources in the Finance-Sub subscription and also view spending details, but cannot create, modify, or delete any resources. Which built-in Azure RBAC role should you assign?

Accepted Answer

Reader. The Reader role is the correct choice because it provides read-only access to all resources in a subscription, including the ability to view resource properties and deployment history, but it does not allow any create, modify, or delete operations. Additionally, the Reader role includes the 'Microsoft.CostManagement/views/read' permission, which enables viewing spending details (cost data) in the Azure portal. This aligns exactly with the requirement to view resources and spending without making changes.

Answer

Owner

Answer

Contributor

Answer

Virtual Machine Contributor

Question 4

Your company wants every subscription under the Corp-MG management group to block the creation of resource groups unless the deployment includes the tags CostCenter and Environment. You need a centralized solution that is inherited by child subscriptions. What should you configure?

Accepted Answer

An Azure Policy assignment at the management group scope. Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.

Answer

A custom RBAC role at the tenant root

Answer

A CanNotDelete lock on each subscription

Answer

A subscription budget alert

Question 5

An Azure application and an Azure Automation account need Azure access without any stored secrets. The same identity should be reusable and should not require manual secret rotation. Which two identity choices meet the requirement? Select two.

Accepted Answer

System-assigned managed identity attached to the resource that needs access.. System-assigned managed identity (Option A) is correct because it is automatically created and tied to a specific Azure resource, such as a virtual machine or App Service, and provides an Azure AD identity that can be used to authenticate to any service supporting Azure AD authentication without storing any secrets. The identity is managed by Azure, eliminating the need for manual secret rotation, and it is automatically deleted when the resource is deleted, ensuring no orphaned secrets.

Answer

Service principal with a client secret stored in an app setting.

Answer

Shared administrator username and password stored in a Key Vault secret.

Answer

SAS token generated once and reused indefinitely by both resources.

Question 6

You need to ensure engineers cannot delete a production resource group, but they must still be able to start and stop VMs and change network rules during maintenance. Which resource lock should you apply to the resource group?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while allowing all other operations, including starting/stopping VMs and modifying network rules. This meets the requirement because engineers retain full management capabilities except for deletion, which is explicitly blocked at the resource group scope.

Answer

No lock

Answer

ReadOnly

Answer

Azure Policy deny assignment

Question 7

An administrator added a user to an Entra security group that already has Contributor on a resource group. The role assignment is correct, but the user still gets 'You do not have access' in the Azure portal 5 minutes later. What is the most likely next step?

Accepted Answer

Have the user sign out and sign back in to refresh the access token.. When a user is added to a security group that already has a role assignment, the new permissions take effect immediately in Azure RBAC, but the user's existing access token (which is cached by the Azure portal) does not include the new group membership claims. The token must be refreshed by signing out and signing back in, or by closing and reopening the browser, to force a new token acquisition that includes the updated role assignments.

Answer

Change the role assignment from the group to the subscription.

Answer

Delete and recreate the resource group.

Answer

Assign Owner directly to the user.

Question 8

A user had a direct Reader assignment on a virtual machine, but that assignment was removed. The user can still open the VM blade and view its properties. Which two sources could still be granting access? Select two.

Accepted Answer

A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.. Azure RBAC permissions are inherited from higher scopes. Even if a direct Reader assignment on the VM is removed, a Reader role assigned at the parent resource group, subscription, or management group scope will still grant the user read access to the VM through inheritance. This is a fundamental behavior of Azure RBAC, where permissions flow down the hierarchy.

Answer

A CanNotDelete lock on the VM is granting the user permission to view it.

Answer

An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.

Answer

A private endpoint connected to the VM subnet is providing inherited read permission through networking.

Question 9

A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?

Accepted Answer

The vm-app01 virtual machine resource itself.. Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.

Answer

The entire subscription that contains vm-app01.

Answer

The resource group that contains vm-app01.

Answer

The management group that contains the subscription.

Question 10

An enterprise wants one governance package to be applied automatically to every production subscription that is added in the future. The package contains several policy definitions that should be managed together. Which two actions are required? Select two.

Accepted Answer

Create or use a production management group and assign the governance package at that scope.. Assigning the governance package (policy initiative) at the management group scope ensures that all child subscriptions, including future ones, automatically inherit the policies. Management groups provide hierarchical governance, and any subscription added under that management group will inherit the assigned policies without manual intervention.

Answer

Assign each policy separately to every resource group so the settings are inherited upward.

Answer

Use tags on resources to make policy definitions automatically apply to new subscriptions.

Answer

Apply a resource lock to the management group so all child subscriptions inherit the policies.

Question 11

Your company has separate subscriptions for development, test, and production. Security wants one baseline policy and one RBAC assignment to apply automatically to every production subscription now and in the future. What should you use?

Accepted Answer

A management group above the production subscriptions.. B is correct because management groups allow you to apply Azure Policy and RBAC assignments hierarchically. By placing all production subscriptions under a single management group, any policy or role assignment at that level will be inherited by every current and future production subscription, meeting the requirement for automatic application without manual intervention.

Answer

A resource group that contains all production resources.

Answer

A tag applied to each production resource.

Answer

A single production subscription with multiple resource groups.

Question 12

A developer has the Contributor role on a subscription. Their ARM deployment of a virtual machine with a public IP fails, and the error message says the request is denied by policy. The developer can create other resources successfully. What should you change to allow this deployment while keeping the Contributor role unchanged?

Accepted Answer

Modify or exempt the Azure Policy assignment that blocks public IP addresses.. The error indicates that an Azure Policy is denying the deployment of a virtual machine with a public IP address. Since the developer has the Contributor role, they have sufficient permissions to create resources, but Azure Policy overrides permissions by enforcing rules. Modifying or creating an exemption for the specific policy that blocks public IP addresses will allow the deployment without changing the developer's role.

Answer

Assign the developer the Owner role on the subscription.

Answer

Remove any lock from the virtual machine's resource group.

Answer

Move the virtual machine to another management group.

Question 13

An Azure Automation account runs PowerShell runbooks that must authenticate to Azure resources without embedded secrets. The automation account is recreated periodically during deployment, and the identity must continue to work after recreation without reissuing credentials. Which identity should you use?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity (B) is the correct choice because it is an independent Azure resource that persists even when the Automation account is recreated. Unlike a system-assigned managed identity, which is tied to the lifecycle of the Automation account and is deleted when the account is deleted, a user-assigned managed identity can be reassigned to the new Automation account after recreation without requiring new credentials. This allows the runbooks to authenticate seamlessly using the same identity, avoiding embedded secrets.

Answer

A system-assigned managed identity.

Answer

A service principal with a client secret stored in Key Vault.

Answer

A shared access signature token.

Question 14

A contractor is a member of an Entra security group that has a PIM-eligible Contributor assignment on a resource group. The contractor sees the role in the portal, but deployment fails with a role not active message. The activation policy requires justification, MFA, and manager approval. Which two actions are required before the deployment succeeds? Select two.

Accepted Answer

Activate the eligible role assignment in Privileged Identity Management.. The contractor has a PIM-eligible role assignment, which means the role is not active until the user activates it through Privileged Identity Management. Activation is a prerequisite for the role to be effective, and without it, any deployment requiring the Contributor role will fail with a 'role not active' message.

Answer

Add the contractor directly to the subscription Owner role to bypass the eligibility workflow.

Answer

Wait for Azure Policy compliance evaluation to finish before trying again.

Answer

Remove the user from the security group and add them back so the role becomes active.

Question 15

Your company has multiple applications deployed across separate production and nonproduction subscriptions. Finance wants cost reporting by application, and each app team should manage only its own resources. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Place each application's Azure resources in a dedicated resource group.. Resource groups are the logical container for grouping Azure resources by application, enabling each app team to manage its own resources via Azure RBAC at the resource group scope. Option B is correct because tagging resources with an application or cost-center identifier allows Azure Cost Management to filter and report costs by application, satisfying the finance requirement for cost reporting by application.

Answer

Create one subscription per virtual machine to simplify chargeback reporting.

Answer

Use resource names only for cost reporting because names are always unique and queryable.

Answer

Place all applications in one management group and use it as the access boundary for each app team.