AZ-104 Manage Azure Identities and Governance Practice Test 7 — 15 Questions

Question 1

Based on the exhibit, an automation account must restart virtual machines and read network interface settings in RG-App. Built-in roles are too broad because they also allow actions the team does not want. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom role with only the required read and restart actions, then assign it at RG-App.. Built-in roles like Virtual Machine Contributor include actions beyond the required scope (e.g., write/delete operations), which the team wants to avoid. A custom role allows precise definition of only the needed actions: 'Microsoft.Compute/virtualMachines/restart/action' and 'Microsoft.Network/networkInterfaces/read'. Assigning this custom role at the RG-App scope ensures least privilege without exposing broader permissions.

Answer

Assign the Reader role at RG-App, because reading permissions automatically include restart actions.

Answer

Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.

Answer

Create a management group and move RG-App into it so only the needed actions are exposed.

Question 2

Central IT wants to apply three related policy definitions—allowed Azure regions, required owner tag, and approved VM sizes—to all subscriptions in the Corp management group and report compliance as one package. What should the administrator create?

Accepted Answer

An initiative. An initiative (also known as a policy set) in Azure Policy allows you to group multiple related policy definitions into a single package. By assigning the initiative to the Corp management group, all subscriptions under that management group inherit the three policies (allowed regions, required owner tag, approved VM sizes) as a bundle, and compliance is reported collectively for the entire initiative.

Answer

A resource lock

Answer

A role assignment

Answer

A managed identity

Question 3

An operations team needs to start and deallocate every virtual machine in RG-App and read VM settings, but they must not be able to delete VMs or manage networking resources. What is the best Azure RBAC solution?

Accepted Answer

Create a custom role and assign it at the RG-App resource group scope. The required permissions—starting, deallocating, and reading VM settings—are not fully covered by any built-in role, and the custom role must be scoped to RG-App to avoid granting broader access. A custom role allows combining Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read, while explicitly excluding delete and networking management actions. Assigning at the resource group scope ensures the permissions apply only to resources within RG-App.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the resource group scope

Answer

Assign the Owner role at the resource group scope

Question 4

Based on the exhibit, three Azure virtual machines run the same automation script. The VMs are rebuilt often, and the team wants one identity that can be reused across all three VMs and retained even if a VM is replaced. Which identity type should the administrator use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. Unlike system-assigned identities, which are tied to the lifecycle of a single VM, a user-assigned identity persists independently and remains available even when VMs are rebuilt or replaced. This allows the automation script to use the same identity across all three VMs without needing to reconfigure permissions after each rebuild.

Answer

System-assigned managed identity on each VM, because each VM gets the same identity automatically.

Answer

An Azure AD guest user account, because the same account can sign in from every VM.

Answer

A shared storage account key, because it can be used by multiple VMs without extra configuration.

Question 5

A build server hosted in a company datacenter must deploy ARM templates to a target resource group in Azure without storing a user password. The server is not running in Azure, and the team wants to authorize deployments with Azure RBAC. What should be configured?

Accepted Answer

A service principal authenticated with a certificate and assigned RBAC on the target scope. A service principal authenticated with a certificate is the correct approach because it allows non-Azure resources (like an on-premises build server) to authenticate to Azure without storing a user password. The certificate-based authentication satisfies the requirement to avoid storing a password, and assigning RBAC on the target resource group grants the service principal the necessary permissions to deploy ARM templates. This method is secure, supports automation, and aligns with Microsoft Entra ID application registration best practices.

Answer

A system-assigned managed identity on the build server

Answer

A personal user account with multifactor authentication

Answer

A shared access signature for the resource group

Question 6

Based on the exhibit, a shared resource group contains a production virtual machine and a storage account. Administrators must be able to update settings, but they must not be able to delete either resource by mistake. Which lock should be applied at the resource group scope?

Accepted Answer

CanNotDelete lock, because it allows updates but blocks deletion.. The CanNotDelete lock (option B) is correct because it allows administrators to update settings on the production VM and storage account while preventing accidental deletion of either resource. This lock operates at the resource group scope, applying to all resources within it, and is the appropriate choice for the stated requirement of allowing updates but blocking deletions.

Answer

ReadOnly lock, because it prevents all changes and keeps resources fully protected.

Answer

No lock is needed because Azure RBAC already prevents deletion by default.

Answer

Management group lock, because all changes in the tenant must be blocked centrally.

Question 7

Based on the exhibit, which identity type should be used so the on-premises build server can authenticate to Azure without using a human account password?

Accepted Answer

Service principal. A service principal is the correct identity type for an on-premises build server to authenticate to Azure without a human account password because it represents a non-human identity that can be assigned to applications, services, and automation tools. Service principals authenticate using client secrets or certificates, enabling secure, password-less authentication via OAuth 2.0 client credentials grant flow, which is ideal for automated build pipelines.

Answer

System-assigned managed identity

Answer

User-assigned managed identity

Answer

Azure Storage access key

Question 8

A policy at the management group denies storage accounts that allow public network access. One legacy storage account in RG-Legacy must stay public for 30 days while a migration runs, and the team does not want to change the policy for everyone else. What should the administrator create?

Accepted Answer

A policy exemption for that storage account. A policy exemption allows specific resources to be excluded from the effect of a policy initiative without modifying the original policy definition. In this scenario, the management group policy denies storage accounts with public network access, but the legacy account needs to remain public temporarily. By creating a policy exemption (with 'exempt' category) for that specific storage account, the administrator can bypass the deny effect for 30 days while the policy continues to apply to all other resources.

Answer

A resource lock on the storage account

Answer

A second policy assignment with higher priority

Answer

A custom RBAC role for the migration team

Question 9

A scheduled script runs on several Azure VMs. The VMs are rebuilt often, and the script must always use the same Azure identity across every rebuild without storing secrets on disk. Which two steps should the administrator take? Select two.

Accepted Answer

Create a user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is an Azure identity that exists independently of any VM and can be assigned to multiple VMs. When a VM is rebuilt, you simply assign the same user-assigned identity to the new VM, and the script can authenticate using the identity's client ID without storing any secrets on disk. This ensures the script always uses the same identity across rebuilds, as the identity's credentials are managed entirely by Azure and rotated automatically.

Answer

Use a system-assigned managed identity on one VM and clone it.

Answer

Store a service principal secret in the script configuration.

Answer

Use a shared access signature to authenticate to Azure Resource Manager.

Question 10

An enterprise wants to enforce three governance controls for all subscriptions under a management group: allowed locations, required tags, and permitted VM sizes. The team wants a single place to assign and track compliance for all three controls. What should the administrator use?

Accepted Answer

One policy initiative assigned at the management group. A policy initiative (also known as a policy set) allows you to group multiple policy definitions (e.g., allowed locations, required tags, permitted VM sizes) into a single, reusable package. Assigning this initiative at the management group level enforces all three governance controls across every subscription under that management group, providing a single place to assign and track compliance via Azure Policy's compliance dashboard.

Answer

Three separate policy assignments at each subscription

Answer

A custom RBAC role assigned to each subscription

Answer

A resource lock on each subscription

Question 11

A scheduled script runs on several Azure virtual machines that are created and replaced over time. The script must use the same Azure identity on every VM, and the identity should continue to exist even if one VM is deleted and recreated. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity is the correct choice because it is an Azure resource that exists independently of any VM, and it can be attached to multiple VMs. When a VM is deleted and recreated, the same user-assigned managed identity can be reattached, ensuring the script uses the same identity consistently. This decouples the identity lifecycle from the VM lifecycle, meeting the requirement for persistence across VM replacements.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal with a client secret stored in each VM.

Answer

A shared access signature stored in the VM registry.

Question 12

Based on the exhibit, the governance team wants to assign three related policy definitions together: allowed regions, required tags, and approved VM SKUs. What should the administrator create first?

Accepted Answer

A policy initiative that groups the three policy definitions into one object.. A policy initiative (also known as a policy set) is the correct answer because it allows you to group multiple related policy definitions into a single assignable object. This is the intended Azure governance pattern for bundling policies like allowed regions, required tags, and approved VM SKUs, ensuring they are applied together consistently across management groups or subscriptions.

Answer

A resource lock so the policies cannot be changed after assignment.

Answer

A custom RBAC role that grants permission to edit policy assignments.

Answer

A management group exemption so all three rules apply automatically.

Question 13

Based on the exhibit, an auditor needs to view all resources in RG-Finance but must not be able to make any changes. The auditor also should not have access to other resource groups. Which RBAC assignment best meets the requirement?

Accepted Answer

Reader at RG-Finance scope, because it allows viewing without granting write permissions.. The Reader role at the RG-Finance scope grants read-only access to all resources within that specific resource group, preventing any modifications. This meets the auditor's requirement to view resources in RG-Finance without write permissions and without access to other resource groups, as the scope is limited to RG-Finance.

Answer

Reader at the subscription scope, because it is read-only and easy to manage.

Answer

Contributor at RG-Finance scope, because the auditor needs to read tags and configuration.

Answer

Reader at the management group scope, because all finance resources are grouped there.

Question 14

Two Azure virtual machines run the same automation script and both need access to Key Vault and Storage. The script must keep working if one VM is redeployed, and the team wants the same identity to be usable by both VMs. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to both VMs. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. This ensures both VMs share the same identity for accessing Key Vault and Storage, and the identity persists independently of any single VM's lifecycle, so redeploying one VM does not break access for the other.

Answer

A system-assigned managed identity on each VM

Answer

A service principal stored in a configuration file on the VMs

Answer

A storage account access key stored in the script

Question 15

Based on the exhibit, which identity should the administrator enable to remove the secret from app settings and have the identity disappear automatically when the app is deleted?

Accepted Answer

System-assigned managed identity. The system-assigned managed identity is tied directly to the lifecycle of the Azure resource (e.g., an App Service). When you enable it, Azure automatically creates a service principal in Microsoft Entra ID for that resource, and you can use the identity to access Azure Key Vault without storing secrets in app settings. When the resource is deleted, the system-assigned managed identity and its corresponding service principal are automatically removed, eliminating the need for manual cleanup.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature