AZ-104 Manage Azure Identities and Governance Practice Test 5 — 15 Questions

Question 1

An Azure Automation account is recreated periodically during a migration project. Runbooks must authenticate to Azure resources without embedded secrets, and the identity must continue to work after the account is rebuilt. Which two choices should you make? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a user-assigned managed identity so the identity is independent of the Automation account lifecycle.. A user-assigned managed identity exists as a standalone Azure resource independent of the Automation account's lifecycle. When the Automation account is recreated, you can reassign the same user-assigned managed identity to the new account, preserving the identity's object ID and its RBAC role assignments. This ensures that runbooks can authenticate without embedded secrets and continue to work seamlessly after the account is rebuilt.

Answer

Use a service principal with a client secret stored in an encrypted Automation variable.

Answer

Use a system-assigned managed identity attached to the Automation account because it is always reusable after recreation.

Answer

Store a storage account key in a runbook asset and retrieve it at runtime.

Question 2

A contractor is a member of an Entra security group that has the Contributor role on a resource group. When the contractor tries to deploy, the portal says the role is not active. The activation request requires approver approval, and the previous activation window has expired. What should the contractor do?

Accepted Answer

Activate the eligible role through Privileged Identity Management and obtain approval if required.. The contractor has an eligible role assignment that requires activation through Privileged Identity Management (PIM). Since the previous activation window has expired, the role is no longer active, and the contractor must initiate a new activation request, which may require approver approval. Option D correctly describes this process, as PIM is the Azure service designed for just-in-time access to privileged roles.

Answer

Wait for the role assignment to propagate to Azure.

Answer

Create a new security group and assign Contributor directly.

Answer

Sign out of the portal and sign back in only.

Question 3

A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?

Accepted Answer

Azure Policy, because it can evaluate and enforce required resource properties.. Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.

Answer

Azure RBAC, because it controls whether users can create resources.

Answer

A resource lock, because it can force resources to use tags.

Answer

A service endpoint, because it can filter which resources are allowed in a subscription.

Question 4

You want to let a support engineer restart only the virtual machines in the Prod-Apps resource group, and any VM added later to that group should also be covered. Where should you assign the role?

Accepted Answer

At the Prod-Apps resource group scope, because the assignment will inherit to all VMs in that group.. Assigning the 'Virtual Machine Contributor' role at the Prod-Apps resource group scope ensures that the support engineer can restart all current and future VMs within that group. Role assignments in Azure RBAC are inherited by all child resources, so any VM added later to the resource group automatically receives the same permissions. This is the most efficient and maintainable approach for managing access to a dynamic set of resources.

Answer

At the subscription scope, because it will cover the resource group and future VMs.

Answer

At each VM resource scope, because role assignments never inherit.

Answer

At the management group scope, because it is the only scope that applies to VMs.

Question 5

A developer already has permission to create resource groups. The company wants to allow deployments only in the East US and West US regions. Which service should enforce this rule?

Accepted Answer

Azure Policy, because it can restrict which regions are allowed for deployments.. Azure Policy is the correct service because it enforces organizational rules by evaluating resource configurations against policy definitions. In this scenario, a built-in or custom policy can restrict allowed regions for all resources, ensuring deployments only occur in East US and West US. Unlike RBAC, which controls who can perform actions, Azure Policy controls what resource configurations are permitted, making it the appropriate tool for region restriction.

Answer

Azure RBAC, because region selection is part of user permissions.

Answer

A network security group, because it can block unsupported regions.

Answer

A read-only lock, because it limits changes to approved regions.

Question 6

A user is assigned the Reader role on a resource group named RG1. Later, a new storage account is created in RG1. What access will the user have to that storage account without any new role assignment?

Accepted Answer

Reader access, because the resource group assignment is inherited by the storage account.. Azure RBAC permissions assigned at a resource group scope are inherited by all resources within that resource group, including resources created after the assignment. Since the user has the Reader role on RG1, that role is inherited by the new storage account, granting read-only access to it without any additional role assignment.

Answer

No access, because RBAC assignments do not apply to resources created later.

Answer

Contributor access, because storage accounts inherit the highest available permissions.

Answer

Owner access, because resource group permissions always become full control on child resources.

Question 7

A company wants development and production workloads for the same application to have separate budgets, separate subscription administrators, and different access controls. The central IT team still wants to apply the same security policies to both environments. What is the best design?

Accepted Answer

Create a separate subscription for dev and prod, then place both subscriptions under the same management group. It uses separate subscriptions for development and production, which provides independent budget tracking, subscription-level role assignments, and separate administrators. Placing both subscriptions under the same management group allows the central IT team to apply consistent Azure Policy and RBAC security policies across both environments via the management group hierarchy, ensuring governance without compromising isolation.

Answer

Use one subscription and separate the environments with tags only

Answer

Use one management group and two resource groups, one for dev and one for prod

Answer

Put production in a management group and development in a resource group

Question 8

An administrator assigns Contributor at the RG-Apps resource group scope and Reader at the subscription scope. A developer opens a VM inside RG-Apps and can change its settings, but a different VM in RG-Shared is read-only. Which statement best explains this behavior?

Accepted Answer

The VM in RG-Apps inherited Contributor from the resource group, while RG-Shared only inherits Reader.. Role assignments in Azure are inherited from higher scopes (subscription, management group) down to lower scopes (resource group, resource). The developer has Reader at the subscription scope, which is inherited by all resource groups, including RG-Shared. However, the Contributor assignment at the RG-Apps resource group scope overrides the inherited Reader for that specific resource group, granting write access to VMs within RG-Apps. RG-Shared has no direct role assignment, so it only inherits the subscription-level Reader, making its VMs read-only.

Answer

The VM in RG-Apps has a direct Contributor assignment that does not apply elsewhere.

Answer

Reader always overrides Contributor when both roles exist in the same subscription.

Answer

Azure Policy is granting write access only inside RG-Apps because the subscription has no policy.

Question 9

Security wants one assignment that enforces all of these controls across several subscriptions: allowed Azure regions, required tags, and disabling public network access on specific resources. Which Azure feature should you use?

Accepted Answer

An Azure Policy initiative that contains multiple related policy definitions. An Azure Policy initiative (also called a policy set) is the correct choice because it groups multiple independent policy definitions into a single assignable unit. This allows you to enforce all three distinct controls—allowed regions, required tags, and disabling public network access—across several subscriptions in one assignment, while keeping each rule as a separate policy definition for easier management and granular effect.

Answer

A single Azure Policy definition with one rule for all three controls

Answer

A management group lock applied to the subscriptions

Answer

A custom RBAC role assigned at the management group

Question 10

A policy that requires secure transfer for storage accounts has been assigned to a subscription with the DeployIfNotExists effect. Several existing storage accounts are still noncompliant and have not changed. What should you do next to update those existing resources automatically?

Accepted Answer

Create and run a remediation task for the policy assignment. The DeployIfNotExists effect on a policy assignment automatically deploys a template to remediate noncompliant resources, but only for new or updated resources. Existing noncompliant resources require a manual remediation task to trigger the deployment of the template. Creating and running a remediation task for the policy assignment applies the required secure transfer configuration to all existing storage accounts, bringing them into compliance.

Answer

Assign a CanNotDelete lock to the storage accounts

Answer

Move the storage accounts into a new resource group

Answer

Grant the administrators a higher RBAC role on the subscription

Question 11

A company has three business units. Each business unit needs its own subscription for billing and admin delegation. Corporate security wants one policy assignment to cover all current and future subscriptions in each business unit. What structure should you implement?

Accepted Answer

Create a management group for each business unit and place that unit's subscriptions underneath it. Management groups allow you to aggregate multiple subscriptions under a single hierarchy, enabling policy assignment at the management group level that applies to all current and future subscriptions within that group. This meets the requirement for per-business-unit billing isolation (via separate subscriptions) and centralized policy enforcement across all subscriptions in each unit.

Answer

Place all resources in one subscription and separate them only by resource group

Answer

Assign the policy at each resource group because policies cannot target subscriptions

Answer

Create one resource group per business unit inside a shared subscription

Question 12

A production resource group contains VMs, public IP addresses, and a storage account. During a migration window, administrators must still be able to change settings and resize VMs, but nobody should accidentally delete any resource. Which lock should you apply to the resource group?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents any user or process from deleting the resource group or its resources, while still allowing all other operations including read, write, and configuration changes such as resizing VMs. This matches the requirement that administrators must be able to change settings and resize VMs but must not accidentally delete any resource.

Answer

ReadOnly

Answer

Contributor

Answer

Azure Policy

Question 13

A support engineer needs to restart only one virtual machine named VM-App01. The engineer must not gain access to any other VM, storage account, or network resource in the resource group. At which scope should you assign the required RBAC role?

Accepted Answer

At the specific virtual machine resource scope. Assigning the Virtual Machine Contributor role at the specific VM resource scope (VM-App01) grants the engineer permissions to restart only that VM, with no access to other VMs, storage accounts, or network resources in the same resource group. RBAC roles applied at a narrower scope (resource level) override broader scopes and limit permissions to that exact resource.

Answer

At the management group scope that contains the subscription

Answer

At the resource group scope that contains the virtual machine

Answer

At the subscription scope that contains the resource group

Question 14

A developer has the Reader role assigned at the subscription scope. Later, the developer is assigned Contributor at the RG-Web resource group scope. Which permission is inherited by a storage account inside RG-Web?

Accepted Answer

The Contributor role from RG-Web is inherited by the storage account.. In Azure RBAC, permissions are inherited from higher scopes to lower scopes. The Contributor role assigned at the RG-Web resource group scope is inherited by all resources within that resource group, including the storage account. The Reader role from the subscription scope is also inherited, but the more permissive Contributor role at the resource group scope takes precedence for actions allowed by Contributor. Therefore, the storage account effectively has Contributor permissions.

Answer

Only the Reader role from the subscription scope is inherited by the storage account.

Answer

Neither role is inherited because storage accounts require a direct assignment.

Answer

Both roles are merged into a new custom role automatically.

Question 15

A change-freeze requires that no one can modify the settings of a subscription's resource group for six hours. Deletion is not the main concern; the priority is to block changes to existing resources during the freeze. Which lock should you apply?

Accepted Answer

ReadOnly. The ReadOnly lock prevents any modification to existing resources, including configuration changes, while still allowing read operations. This directly satisfies the change-freeze requirement to block changes for six hours, as it denies all write operations at the resource group scope.

Answer

CanNotDelete

Answer

Reader

Answer

DeployIfNotExists