AZ-104 Manage Azure Identities and Governance Practice Test 5 — 15 Questions

Question 1

A policy assigned at the management group denies creation of storage accounts with public network access enabled. One legacy storage account in RG-Pilot must stay publicly reachable for 45 days while an application is migrated. What should the administrator configure?

Accepted Answer

Create a policy exemption for the specific storage account with an expiration date.. A policy exemption is the correct tool when a specific resource must temporarily diverge from an enforced policy. The deny policy stays in place for the management group, but the exempted storage account is allowed to remain publicly reachable during the migration window. This keeps governance intact while documenting the exception and its expiration, which is much safer than removing the policy or trying to solve a compliance issue with RBAC.

Why others are wrong: Removing the policy assignment would disable governance for all resources under the management group, not just the one legacy storage account. A CanNotDelete lock protects against deletion only; it does not affect policy evaluation or network access settings. Granting Contributor does not help because Azure Policy is evaluated separately from RBAC, so more permission does not override a deny policy.

Answer

Remove the policy assignment from the management group until the migration is finished.

Answer

Apply a CanNotDelete lock to the storage account.

Answer

Assign a Contributor role to the migration team on the storage account.

Question 2

A VM-hosted automation tool must call Azure APIs without storing a password or certificate on disk. The identity should disappear automatically when the VM is deleted. Which identity should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure APIs without storing any credentials (password or certificate) on disk, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A service principal with a client secret

Answer

A storage account access key

Question 3

A web app and a VM scale set both need the same Azure identity to read secrets from Key Vault. The identity must survive redeployment, and the team wants to remove it centrally without changing each resource individually. Which identity type should they use?

Accepted Answer

A user-assigned managed identity attached to both resources.. A user-assigned managed identity (B) is the correct choice because it is created as a standalone Azure resource, can be attached to multiple Azure resources (e.g., a web app and a VM scale set), and persists independently of those resources. This allows the identity to survive redeployment of either resource and enables centralized removal (by deleting the user-assigned identity) without needing to modify each resource individually.

Answer

A system-assigned managed identity on each resource.

Answer

A service principal with a client secret stored in application settings.

Answer

A resource lock on the Key Vault to preserve the secret access path.

Question 4

Based on the exhibit, a compliance dashboard shows that several storage accounts are marked noncompliant because they do not have the required tag. The policy itself is correct, but one business unit needs a temporary exception for a single resource group during a merger. What should the administrator configure?

Accepted Answer

A policy exemption at the rg-merger01 resource group scope.. A policy exemption at the rg-merger01 resource group scope is the correct solution because it allows the administrator to temporarily exclude a specific resource group from the policy's enforcement or compliance evaluation without modifying or deleting the original policy assignment. This is designed for scenarios like mergers where a short-term exception is needed, and it maintains the policy's integrity for all other scopes.

Answer

Delete the policy assignment from corp-root and recreate it later.

Answer

Move rg-merger01 to a separate subscription so the policy no longer applies.

Answer

Change the policy effect to Audit so the resources can remain noncompliant.

Question 5

Based on the exhibit, a contractor must be able to restart only one virtual machine named vm-pay-01 and read its properties. The contractor must not be able to manage any other VM in the resource group. Where should the role assignment be created?

Accepted Answer

At the resource scope for vm-pay-01 so the contractor receives permissions only on that VM.. Option B is correct because Azure RBAC allows role assignments at the resource scope, which in this case is the virtual machine vm-pay-01. By assigning a role (e.g., Virtual Machine Contributor or a custom role with restart and read permissions) directly to the VM resource, the contractor receives permissions only on that specific VM, fulfilling the requirement to restrict access to other VMs in the resource group.

Answer

At the subscription scope so the contractor inherits access everywhere in the subscription.

Answer

At the resource group scope because resource assignments cannot be applied to virtual machines.

Answer

At the management group scope so the same role can be reused for all payroll subscriptions.

Question 6

A cloud operations team in the Corp business unit needs to read all Azure resources in every current and future subscription under the Corp management group to prepare monthly governance reports. They must not gain access to subscriptions that belong to other business units. What scope should the administrator use when assigning the Reader role?

Accepted Answer

Management group scope. The Reader role assigned at the management group scope grants read-only access to all subscriptions within that management group, including future subscriptions, because Azure RBAC permissions are inherited by child resources. This meets the requirement to cover all current and future subscriptions under the Corp management group while excluding subscriptions in other business units.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 7

An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?

Accepted Answer

An initiative assigned at the management group scope.. An initiative (policy set) allows grouping multiple policy definitions into a single assignment, which can be assigned at the management group scope to enforce both the allowed regions and costCenter tag requirements. This approach supports future growth by simply adding new policy definitions to the initiative without creating separate assignments. Assigning at the management group scope ensures the controls cascade to all child subscriptions.

Answer

A single Azure Policy assignment that contains both requirements as separate policy rules.

Answer

A role assignment at the management group scope.

Answer

A resource lock applied to each subscription.

Question 8

Based on the exhibit, which Azure construct should the administrator create to group these related policy rules into one assignment?

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of policy definitions designed to group related policies into a single assignable unit. This allows the administrator to apply multiple policy rules together for consistent governance across resources, which is exactly what the question describes.

Answer

Resource lock

Answer

Azure RBAC custom role

Answer

Policy exemption

Question 9

A shared resource group contains a critical virtual machine and a storage account. Administrators must still be able to update settings, but nobody should accidentally delete either resource during routine maintenance. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group.. The CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it, while still allowing administrators to update settings. This meets the requirement of protecting both the critical VM and storage account from accidental deletion during routine maintenance, without blocking configuration changes.

Answer

ReadOnly lock on the resource group.

Answer

A policy assignment that denies delete operations.

Answer

A management group assignment with Contributor removed.

Question 10

A shared resource group contains a VM and a storage account used by payroll. Administrators still need to modify configuration and apply patches, but accidental deletion of either resource must be prevented. What should the administrator apply?

Accepted Answer

A CanNotDelete lock on each resource.. Option B is correct because a CanNotDelete lock prevents the deletion of a resource while still allowing all other operations, including configuration modifications and patching. This meets the requirement of protecting the VM and storage account from accidental deletion while preserving administrative access for updates.

Answer

A ReadOnly lock on the entire resource group.

Answer

A policy assignment that denies delete operations on the resource group.

Answer

A management group with a deny assignment.

Question 11

A compliance team wants to bundle three policy definitions—allowed locations, required cost center tags, and approved VM sizes—so they can assign them together to a management group and review compliance in one place. Later they want to exempt one pilot subscription from the entire set for 60 days. What should they use?

Accepted Answer

A policy initiative at the management group scope.. A policy initiative (also called a policy set) allows you to group multiple policy definitions into a single, reusable bundle. By assigning the initiative at the management group scope, all three policies apply together to every subscription under that group. When the pilot subscription needs an exemption, you can create an exemption resource on that subscription for the entire initiative, specifying a 60-day expiration, which temporarily excludes it from all bundled policies while keeping compliance reporting unified.

Answer

A custom RBAC role with resource permissions for policy management.

Answer

A resource lock on the pilot subscription.

Answer

A separate management group for each of the three policy definitions.

Question 12

Based on the exhibit, an automation account must restart virtual machines and read network interface settings in RG-App. Built-in roles are too broad because they also allow actions the team does not want. What should the administrator do?

Accepted Answer

Create a custom role with only the required read and restart actions, then assign it at RG-App.. Option B is correct because built-in roles like Virtual Machine Contributor include actions beyond the required scope (e.g., write/delete operations), which the team wants to avoid. A custom role allows precise definition of only the needed actions: 'Microsoft.Compute/virtualMachines/restart/action' and 'Microsoft.Network/networkInterfaces/read'. Assigning this custom role at the RG-App scope ensures least privilege without exposing broader permissions.

Answer

Assign the Reader role at RG-App, because reading permissions automatically include restart actions.

Answer

Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.

Answer

Create a management group and move RG-App into it so only the needed actions are exposed.

Question 13

Central IT wants to apply three related policy definitions—allowed Azure regions, required owner tag, and approved VM sizes—to all subscriptions in the Corp management group and report compliance as one package. What should the administrator create?

Accepted Answer

An initiative. An initiative (also known as a policy set) in Azure Policy allows you to group multiple related policy definitions into a single package. By assigning the initiative to the Corp management group, all subscriptions under that management group inherit the three policies (allowed regions, required owner tag, approved VM sizes) as a bundle, and compliance is reported collectively for the entire initiative.

Answer

A resource lock

Answer

A role assignment

Answer

A managed identity

Question 14

An operations team needs to start and deallocate every virtual machine in RG-App and read VM settings, but they must not be able to delete VMs or manage networking resources. What is the best Azure RBAC solution?

Accepted Answer

Create a custom role and assign it at the RG-App resource group scope. Option B is correct because the required permissions—starting, deallocating, and reading VM settings—are not fully covered by any built-in role, and the custom role must be scoped to RG-App to avoid granting broader access. A custom role allows combining Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read, while explicitly excluding delete and networking management actions. Assigning at the resource group scope ensures the permissions apply only to resources within RG-App.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the resource group scope

Answer

Assign the Owner role at the resource group scope

Question 15

Based on the exhibit, three Azure virtual machines run the same automation script. The VMs are rebuilt often, and the team wants one identity that can be reused across all three VMs and retained even if a VM is replaced. Which identity type should the administrator use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. Unlike system-assigned identities, which are tied to the lifecycle of a single VM, a user-assigned identity persists independently and remains available even when VMs are rebuilt or replaced. This allows the automation script to use the same identity across all three VMs without needing to reconfigure permissions after each rebuild.

Answer

System-assigned managed identity on each VM, because each VM gets the same identity automatically.

Answer

An Azure AD guest user account, because the same account can sign in from every VM.

Answer

A shared storage account key, because it can be used by multiple VMs without extra configuration.