AZ-104 Manage Azure Identities and Governance Practice Test 6 — 15 Questions

Question 1

A production resource group contains VMs, public IP addresses, and a storage account. During a migration window, administrators must still be able to change settings and resize VMs, but nobody should accidentally delete any resource. Which lock should you apply to the resource group?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents any user or process from deleting the resource group or its resources, while still allowing all other operations including read, write, and configuration changes such as resizing VMs. This matches the requirement that administrators must be able to change settings and resize VMs but must not accidentally delete any resource.

Answer

ReadOnly

Answer

Contributor

Answer

Azure Policy

Question 2

A support engineer needs to restart only one virtual machine named VM-App01. The engineer must not gain access to any other VM, storage account, or network resource in the resource group. At which scope should you assign the required RBAC role?

Accepted Answer

At the specific virtual machine resource scope. Assigning the Virtual Machine Contributor role at the specific VM resource scope (VM-App01) grants the engineer permissions to restart only that VM, with no access to other VMs, storage accounts, or network resources in the same resource group. RBAC roles applied at a narrower scope (resource level) override broader scopes and limit permissions to that exact resource.

Answer

At the management group scope that contains the subscription

Answer

At the resource group scope that contains the virtual machine

Answer

At the subscription scope that contains the resource group

Question 3

A developer has the Reader role assigned at the subscription scope. Later, the developer is assigned Contributor at the RG-Web resource group scope. Which permission is inherited by a storage account inside RG-Web?

Accepted Answer

The Contributor role from RG-Web is inherited by the storage account.. In Azure RBAC, permissions are inherited from higher scopes to lower scopes. The Contributor role assigned at the RG-Web resource group scope is inherited by all resources within that resource group, including the storage account. The Reader role from the subscription scope is also inherited, but the more permissive Contributor role at the resource group scope takes precedence for actions allowed by Contributor. Therefore, the storage account effectively has Contributor permissions.

Answer

Only the Reader role from the subscription scope is inherited by the storage account.

Answer

Neither role is inherited because storage accounts require a direct assignment.

Answer

Both roles are merged into a new custom role automatically.

Question 4

A change-freeze requires that no one can modify the settings of a subscription's resource group for six hours. Deletion is not the main concern; the priority is to block changes to existing resources during the freeze. Which lock should you apply?

Accepted Answer

ReadOnly. The ReadOnly lock prevents any modification to existing resources, including configuration changes, while still allowing read operations. This directly satisfies the change-freeze requirement to block changes for six hours, as it denies all write operations at the resource group scope.

Answer

CanNotDelete

Answer

Reader

Answer

DeployIfNotExists

Question 5

A deny policy blocks creation of storage accounts with public network access enabled. A legacy application in RG-Legacy must keep one existing storage account publicly reachable for 45 days while the rest of the subscription remains governed by the policy. What should the administrator configure?

Accepted Answer

A policy exemption at the RG-Legacy scope with an expiration date.. A policy exemption at the RG-Legacy scope with an expiration date is the correct solution because it allows the specific storage account to bypass the deny policy while keeping the policy enforced for all other resources. The exemption can be scoped to the resource group and set to expire in 45 days, ensuring the legacy application retains public access temporarily without permanently weakening the governance posture. This approach directly addresses the requirement to maintain compliance for the rest of the subscription.

Answer

A new role assignment that grants Owner on RG-Legacy.

Answer

A management lock on the storage account.

Answer

A separate initiative assigned only to RG-Legacy with the deny setting disabled.

Question 6

A policy assigned at the management group denies creation of storage accounts with public network access enabled. One legacy storage account in RG-Pilot must stay publicly reachable for 45 days while an application is migrated. What should the administrator configure?

Accepted Answer

Create a policy exemption for the specific storage account with an expiration date.. Azure Policy exemptions are purpose-built for this scenario: they allow a specific resource or resource group to be excluded from a policy assignment, and they support an expiration date (expiresOn) so the exemption auto-expires after the migration window. The exemption is scoped to the storage account, so the rest of the management group remains protected by the deny policy.

Answer

Remove the policy assignment from the management group until the migration is finished.

Answer

Apply a CanNotDelete lock to the storage account.

Answer

Assign a Contributor role to the migration team on the storage account.

Question 7

A VM-hosted automation tool must call Azure APIs without storing a password or certificate on disk. The identity should disappear automatically when the VM is deleted. Which identity should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure APIs without storing any credentials (password or certificate) on disk, using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A service principal with a client secret

Answer

A storage account access key

Question 8

A web app and a VM scale set both need the same Azure identity to read secrets from Key Vault. The identity must survive redeployment, and the team wants to remove it centrally without changing each resource individually. Which identity type should they use?

Accepted Answer

A user-assigned managed identity attached to both resources.. A user-assigned managed identity (B) is the correct choice because it is created as a standalone Azure resource, can be attached to multiple Azure resources (e.g., a web app and a VM scale set), and persists independently of those resources. This allows the identity to survive redeployment of either resource and enables centralized removal (by deleting the user-assigned identity) without needing to modify each resource individually.

Answer

A system-assigned managed identity on each resource.

Answer

A service principal with a client secret stored in application settings.

Answer

A resource lock on the Key Vault to preserve the secret access path.

Question 9

Based on the exhibit, a compliance dashboard shows that several storage accounts are marked noncompliant because they do not have the required tag. The policy itself is correct, but one business unit needs a temporary exception for a single resource group during a merger. What should the administrator configure?

Accepted Answer

A policy exemption at the rg-merger01 resource group scope.. A policy exemption at the rg-merger01 resource group scope is the correct solution because it allows the administrator to temporarily exclude a specific resource group from the policy's enforcement or compliance evaluation without modifying or deleting the original policy assignment. This is designed for scenarios like mergers where a short-term exception is needed, and it maintains the policy's integrity for all other scopes.

Answer

Delete the policy assignment from corp-root and recreate it later.

Answer

Move rg-merger01 to a separate subscription so the policy no longer applies.

Answer

Change the policy effect to Audit so the resources can remain noncompliant.

Question 10

Based on the exhibit, a contractor must be able to restart only one virtual machine named vm-pay-01 and read its properties. The contractor must not be able to manage any other VM in the resource group. Where should the role assignment be created?

Accepted Answer

At the resource scope for vm-pay-01 so the contractor receives permissions only on that VM.. Azure RBAC allows role assignments at the resource scope, which in this case is the virtual machine vm-pay-01. By assigning a role (e.g., Virtual Machine Contributor or a custom role with restart and read permissions) directly to the VM resource, the contractor receives permissions only on that specific VM, fulfilling the requirement to restrict access to other VMs in the resource group.

Answer

At the subscription scope so the contractor inherits access everywhere in the subscription.

Answer

At the resource group scope because resource assignments cannot be applied to virtual machines.

Answer

At the management group scope so the same role can be reused for all payroll subscriptions.

Question 11

A cloud operations team in the Corp business unit needs to read all Azure resources in every current and future subscription under the Corp management group to prepare monthly governance reports. They must not gain access to subscriptions that belong to other business units. What scope should the administrator use when assigning the Reader role?

Accepted Answer

Management group scope. The Reader role assigned at the management group scope grants read-only access to all subscriptions within that management group, including future subscriptions, because Azure RBAC permissions are inherited by child resources. This meets the requirement to cover all current and future subscriptions under the Corp management group while excluding subscriptions in other business units.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 12

An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?

Accepted Answer

An initiative assigned at the management group scope.. An initiative (policy set) allows grouping multiple policy definitions into a single assignment, which can be assigned at the management group scope to enforce both the allowed regions and costCenter tag requirements. This approach supports future growth by simply adding new policy definitions to the initiative without creating separate assignments. Assigning at the management group scope ensures the controls cascade to all child subscriptions.

Answer

A single Azure Policy assignment that contains both requirements as separate policy rules.

Answer

A role assignment at the management group scope.

Answer

A resource lock applied to each subscription.

Question 13

Based on the exhibit, which Azure construct should the administrator create to group these related policy rules into one assignment?

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of policy definitions designed to group related policies into a single assignable unit. This allows the administrator to apply multiple policy rules together for consistent governance across resources, which is exactly what the question describes.

Answer

Resource lock

Answer

Azure RBAC custom role

Answer

Policy exemption

Question 14

A shared resource group contains a VM and a storage account used by payroll. Administrators still need to modify configuration and apply patches, but accidental deletion of either resource must be prevented. What should the administrator apply?

Accepted Answer

A CanNotDelete lock on each resource.. A CanNotDelete lock prevents the deletion of a resource while still allowing all other operations, including configuration modifications and patching. This meets the requirement of protecting the VM and storage account from accidental deletion while preserving administrative access for updates.

Answer

A ReadOnly lock on the entire resource group.

Answer

A policy assignment that denies delete operations on the resource group.

Answer

A management group with a deny assignment.

Question 15

A compliance team wants to bundle three policy definitions—allowed locations, required cost center tags, and approved VM sizes—so they can assign them together to a management group and review compliance in one place. Later they want to exempt one pilot subscription from the entire set for 60 days. What should they use?

Accepted Answer

A policy initiative at the management group scope.. A policy initiative (also called a policy set) allows you to group multiple policy definitions into a single, reusable bundle. By assigning the initiative at the management group scope, all three policies apply together to every subscription under that group. When the pilot subscription needs an exemption, you can create an exemption resource on that subscription for the entire initiative, specifying a 60-day expiration, which temporarily excludes it from all bundled policies while keeping compliance reporting unified.

Answer

A custom RBAC role with resource permissions for policy management.

Answer

A resource lock on the pilot subscription.

Answer

A separate management group for each of the three policy definitions.