AZ-104 Manage Azure Identities and Governance Practice Test 5 — 15 Questions

Question 1

Your company has separate subscriptions for development, test, and production. Security wants one baseline policy and one RBAC assignment to apply automatically to every production subscription now and in the future. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A management group above the production subscriptions.. B is correct because management groups allow you to apply Azure Policy and RBAC assignments hierarchically. By placing all production subscriptions under a single management group, any policy or role assignment at that level will be inherited by every current and future production subscription, meeting the requirement for automatic application without manual intervention.

Answer

A resource group that contains all production resources.

Answer

A tag applied to each production resource.

Answer

A single production subscription with multiple resource groups.

Question 2

A developer has the Contributor role on a subscription. Their ARM deployment of a virtual machine with a public IP fails, and the error message says the request is denied by policy. The developer can create other resources successfully. What should you change to allow this deployment while keeping the Contributor role unchanged?

Accepted Answer

Modify or exempt the Azure Policy assignment that blocks public IP addresses.. The error indicates that an Azure Policy is denying the deployment of a virtual machine with a public IP address. Since the developer has the Contributor role, they have sufficient permissions to create resources, but Azure Policy overrides permissions by enforcing rules. Modifying or creating an exemption for the specific policy that blocks public IP addresses will allow the deployment without changing the developer's role.

Answer

Assign the developer the Owner role on the subscription.

Answer

Remove any lock from the virtual machine's resource group.

Answer

Move the virtual machine to another management group.

Question 3

An Azure Automation account runs PowerShell runbooks that must authenticate to Azure resources without embedded secrets. The automation account is recreated periodically during deployment, and the identity must continue to work after recreation without reissuing credentials. Which identity should you use?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity (B) is the correct choice because it is an independent Azure resource that persists even when the Automation account is recreated. Unlike a system-assigned managed identity, which is tied to the lifecycle of the Automation account and is deleted when the account is deleted, a user-assigned managed identity can be reassigned to the new Automation account after recreation without requiring new credentials. This allows the runbooks to authenticate seamlessly using the same identity, avoiding embedded secrets.

Answer

A system-assigned managed identity.

Answer

A service principal with a client secret stored in Key Vault.

Answer

A shared access signature token.

Question 4

A contractor is a member of an Entra security group that has a PIM-eligible Contributor assignment on a resource group. The contractor sees the role in the portal, but deployment fails with a role not active message. The activation policy requires justification, MFA, and manager approval. Which two actions are required before the deployment succeeds? Select two.

Accepted Answer

Activate the eligible role assignment in Privileged Identity Management.. The contractor has a PIM-eligible role assignment, which means the role is not active until the user activates it through Privileged Identity Management. Activation is a prerequisite for the role to be effective, and without it, any deployment requiring the Contributor role will fail with a 'role not active' message.

Answer

Add the contractor directly to the subscription Owner role to bypass the eligibility workflow.

Answer

Wait for Azure Policy compliance evaluation to finish before trying again.

Answer

Remove the user from the security group and add them back so the role becomes active.

Question 5

Your company has multiple applications deployed across separate production and nonproduction subscriptions. Finance wants cost reporting by application, and each app team should manage only its own resources. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Place each application's Azure resources in a dedicated resource group.. Resource groups are the logical container for grouping Azure resources by application, enabling each app team to manage its own resources via Azure RBAC at the resource group scope. Option B is correct because tagging resources with an application or cost-center identifier allows Azure Cost Management to filter and report costs by application, satisfying the finance requirement for cost reporting by application.

Answer

Create one subscription per virtual machine to simplify chargeback reporting.

Answer

Use resource names only for cost reporting because names are always unique and queryable.

Answer

Place all applications in one management group and use it as the access boundary for each app team.

Question 6

An Azure Automation account is recreated periodically during a migration project. Runbooks must authenticate to Azure resources without embedded secrets, and the identity must continue to work after the account is rebuilt. Which two choices should you make? Select two.

Accepted Answer

Use a user-assigned managed identity so the identity is independent of the Automation account lifecycle.. A user-assigned managed identity exists as a standalone Azure resource independent of the Automation account's lifecycle. When the Automation account is recreated, you can reassign the same user-assigned managed identity to the new account, preserving the identity's object ID and its RBAC role assignments. This ensures that runbooks can authenticate without embedded secrets and continue to work seamlessly after the account is rebuilt.

Answer

Use a service principal with a client secret stored in an encrypted Automation variable.

Answer

Use a system-assigned managed identity attached to the Automation account because it is always reusable after recreation.

Answer

Store a storage account key in a runbook asset and retrieve it at runtime.

Question 7

A contractor is a member of an Entra security group that has the Contributor role on a resource group. When the contractor tries to deploy, the portal says the role is not active. The activation request requires approver approval, and the previous activation window has expired. What should the contractor do?

Accepted Answer

Activate the eligible role through Privileged Identity Management and obtain approval if required.. The contractor has an eligible role assignment that requires activation through Privileged Identity Management (PIM). Since the previous activation window has expired, the role is no longer active, and the contractor must initiate a new activation request, which may require approver approval. Option D correctly describes this process, as PIM is the Azure service designed for just-in-time access to privileged roles.

Answer

Wait for the role assignment to propagate to Azure.

Answer

Create a new security group and assign Contributor directly.

Answer

Sign out of the portal and sign back in only.

Question 8

A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?

Accepted Answer

Azure Policy, because it can evaluate and enforce required resource properties.. Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.

Answer

Azure RBAC, because it controls whether users can create resources.

Answer

A resource lock, because it can force resources to use tags.

Answer

A service endpoint, because it can filter which resources are allowed in a subscription.

Question 9

A developer already has permission to create resource groups. The company wants to allow deployments only in the East US and West US regions. Which service should enforce this rule?

Accepted Answer

Azure Policy, because it can restrict which regions are allowed for deployments.. Azure Policy is the correct service because it enforces organizational rules by evaluating resource configurations against policy definitions. In this scenario, a built-in or custom policy can restrict allowed regions for all resources, ensuring deployments only occur in East US and West US. Unlike RBAC, which controls who can perform actions, Azure Policy controls what resource configurations are permitted, making it the appropriate tool for region restriction.

Answer

Azure RBAC, because region selection is part of user permissions.

Answer

A network security group, because it can block unsupported regions.

Answer

A read-only lock, because it limits changes to approved regions.

Question 10

A user is assigned the Reader role on a resource group named RG1. Later, a new storage account is created in RG1. What access will the user have to that storage account without any new role assignment?

Accepted Answer

Reader access, because the resource group assignment is inherited by the storage account.. Azure RBAC permissions assigned at a resource group scope are inherited by all resources within that resource group, including resources created after the assignment. Since the user has the Reader role on RG1, that role is inherited by the new storage account, granting read-only access to it without any additional role assignment.

Answer

No access, because RBAC assignments do not apply to resources created later.

Answer

Contributor access, because storage accounts inherit the highest available permissions.

Answer

Owner access, because resource group permissions always become full control on child resources.

Question 11

A company wants development and production workloads for the same application to have separate budgets, separate subscription administrators, and different access controls. The central IT team still wants to apply the same security policies to both environments. What is the best design?

Accepted Answer

Create a separate subscription for dev and prod, then place both subscriptions under the same management group. It uses separate subscriptions for development and production, which provides independent budget tracking, subscription-level role assignments, and separate administrators. Placing both subscriptions under the same management group allows the central IT team to apply consistent Azure Policy and RBAC security policies across both environments via the management group hierarchy, ensuring governance without compromising isolation.

Answer

Use one subscription and separate the environments with tags only

Answer

Use one management group and two resource groups, one for dev and one for prod

Answer

Put production in a management group and development in a resource group

Question 12

An administrator assigns Contributor at the RG-Apps resource group scope and Reader at the subscription scope. A developer opens a VM inside RG-Apps and can change its settings, but a different VM in RG-Shared is read-only. Which statement best explains this behavior?

Accepted Answer

The VM in RG-Apps inherited Contributor from the resource group, while RG-Shared only inherits Reader.. Role assignments in Azure are inherited from higher scopes (subscription, management group) down to lower scopes (resource group, resource). The developer has Reader at the subscription scope, which is inherited by all resource groups, including RG-Shared. However, the Contributor assignment at the RG-Apps resource group scope overrides the inherited Reader for that specific resource group, granting write access to VMs within RG-Apps. RG-Shared has no direct role assignment, so it only inherits the subscription-level Reader, making its VMs read-only.

Answer

The VM in RG-Apps has a direct Contributor assignment that does not apply elsewhere.

Answer

Reader always overrides Contributor when both roles exist in the same subscription.

Answer

Azure Policy is granting write access only inside RG-Apps because the subscription has no policy.

Question 13

Security wants one assignment that enforces all of these controls across several subscriptions: allowed Azure regions, required tags, and disabling public network access on specific resources. Which Azure feature should you use?

Accepted Answer

An Azure Policy initiative that contains multiple related policy definitions. An Azure Policy initiative (also called a policy set) is the correct choice because it groups multiple independent policy definitions into a single assignable unit. This allows you to enforce all three distinct controls—allowed regions, required tags, and disabling public network access—across several subscriptions in one assignment, while keeping each rule as a separate policy definition for easier management and granular effect.

Answer

A single Azure Policy definition with one rule for all three controls

Answer

A management group lock applied to the subscriptions

Answer

A custom RBAC role assigned at the management group

Question 14

A policy that requires secure transfer for storage accounts has been assigned to a subscription with the DeployIfNotExists effect. Several existing storage accounts are still noncompliant and have not changed. What should you do next to update those existing resources automatically?

Accepted Answer

Create and run a remediation task for the policy assignment. The DeployIfNotExists effect on a policy assignment automatically deploys a template to remediate noncompliant resources, but only for new or updated resources. Existing noncompliant resources require a manual remediation task to trigger the deployment of the template. Creating and running a remediation task for the policy assignment applies the required secure transfer configuration to all existing storage accounts, bringing them into compliance.

Answer

Assign a CanNotDelete lock to the storage accounts

Answer

Move the storage accounts into a new resource group

Answer

Grant the administrators a higher RBAC role on the subscription

Question 15

A company has three business units. Each business unit needs its own subscription for billing and admin delegation. Corporate security wants one policy assignment to cover all current and future subscriptions in each business unit. What structure should you implement?

Accepted Answer

Create a management group for each business unit and place that unit's subscriptions underneath it. Management groups allow you to aggregate multiple subscriptions under a single hierarchy, enabling policy assignment at the management group level that applies to all current and future subscriptions within that group. This meets the requirement for per-business-unit billing isolation (via separate subscriptions) and centralized policy enforcement across all subscriptions in each unit.

Answer

Place all resources in one subscription and separate them only by resource group

Answer

Assign the policy at each resource group because policies cannot target subscriptions

Answer

Create one resource group per business unit inside a shared subscription