AZ-104 Manage Azure Identities and Governance Practice Test 7 — 15 Questions

Question 1

A build server in an on-premises datacenter must deploy ARM templates to Azure. The automation must not use a human account password, and Microsoft Entra conditional access for device sign-in is not available because the server is outside Azure. The security team allows a non-human credential but wants the strongest practical option for this scenario. What should the administrator configure?

Accepted Answer

A service principal authenticated with a certificate.. Option B is correct because a service principal authenticated with a certificate provides a non-human credential that does not require a human password and is the strongest practical option for an on-premises build server that cannot use managed identities (which are Azure-resource-scoped) or device-based conditional access. Certificate-based authentication for service principals uses asymmetric cryptography (X.509 certificates) with a private key stored securely on the build server, offering higher security than a client secret and meeting the requirement to avoid human account passwords.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity shared with the build server.

Answer

A resource lock on the target resource group to permit template deployment.

Question 2

A system-assigned managed identity is attached to an Azure VM to call Key Vault. The VM is frequently reimaged and sometimes redeployed to a different name during scale events, but the application must keep the same identity and secretless access. What should the administrator use instead?

Accepted Answer

A user-assigned managed identity associated with the workload.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently when VMs are reimaged or redeployed with different names. This allows the application to retain the same identity and secretless access to Key Vault without requiring manual reconfiguration or credential rotation.

Answer

A system-assigned managed identity on each newly deployed VM.

Answer

A shared storage account key placed in the VM custom script.

Answer

A policy exemption for the Key Vault access policy.

Question 3

An App Service application needs to read secrets from Azure Key Vault. The security team does not want any password, certificate, or client secret stored in application settings, and they want the identity removed automatically if the app is deleted. What should the administrator enable?

Accepted Answer

A system-assigned managed identity on the App Service.. A system-assigned managed identity (Option B) is the correct choice because it provides an identity for the App Service that is automatically managed by Azure, tied to the lifecycle of the resource (deleted when the app is deleted), and requires no credentials to be stored in application settings. This allows the app to authenticate to Key Vault using Azure AD tokens without any secrets, satisfying the security team's requirements.

Answer

A service principal with a client secret stored in App Service configuration.

Answer

A user-assigned managed identity shared by all applications.

Answer

A shared access signature stored in Key Vault.

Question 4

A VM-hosted automation tool must call Azure Resource Manager APIs, but the team will not store a password, certificate, or client secret on the VM. The identity should also disappear automatically when the VM is deleted. Which identity should be assigned?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM—when the VM is deleted, the identity is automatically removed. It allows the automation tool to authenticate to Azure Resource Manager APIs without storing any credentials (password, certificate, or client secret) on the VM, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature

Question 5

Based on the exhibit, a policy assigned at the subscription denies storage accounts that allow public network access. One existing storage account in RG-Legacy must remain publicly reachable for 30 days while a migration is completed. What should the administrator use?

Accepted Answer

Create a policy exemption for stlegacy01 at the resource scope.. A policy exemption at the resource scope is the correct approach because it allows the administrator to selectively exclude the specific storage account (stlegacy01) from the subscription-level policy that denies public network access. This exemption can be configured with an expiration date of 30 days, ensuring the legacy account remains publicly reachable during the migration while the policy continues to apply to all other resources. Policy exemptions are designed for exactly this scenario—temporary exceptions for compliance or migration needs—without altering the policy definition or assignment.

Answer

Remove the policy assignment from the subscription until the migration finishes.

Answer

Change the policy effect from Deny to Audit.

Answer

Move the legacy storage account to a separate subscription and assign the policy there.

Question 6

A company has 18 Azure subscriptions. Production subscriptions must inherit stricter governance than sandbox subscriptions, and central IT wants one place to target future policy assignments to each group. What should the administrator do?

Accepted Answer

Create management groups for Prod and Sandbox, then move subscriptions into them. Management groups allow you to organize Azure subscriptions hierarchically and apply Azure Policy and role-based access control (RBAC) at the management group level, which is inherited by all subscriptions within that group. By creating separate management groups for Prod and Sandbox and moving the respective subscriptions into them, central IT can assign policy assignments once to each management group, ensuring stricter governance for production subscriptions and a lighter touch for sandbox subscriptions.

Answer

Create resource groups named Prod and Sandbox in each subscription

Answer

Use tags on subscriptions to separate production from sandbox

Answer

Apply a CanNotDelete lock to each subscription

Question 7

A policy assignment denies storage accounts unless public network access is disabled. One legacy storage account in a pilot resource group must remain publicly reachable for 60 days while the application team remediates dependencies. Compliance reporting must continue to show the policy as enforced everywhere else. What should the administrator do?

Accepted Answer

Use an Azure Policy exemption for that storage account. An Azure Policy exemption allows the administrator to exclude a specific scope (the legacy storage account) from the policy's effect while still reporting the policy as enforced on all other resources. The exemption can be set with an expiration date (60 days) to automatically remove the exception after the remediation period. This ensures compliance reporting continues to show the policy as active and enforced everywhere except the exempted resource.

Answer

Delete the policy assignment and re-create it later

Answer

Apply a read-only lock to the storage account

Answer

Assign a custom RBAC role to the application team

Question 8

Based on the exhibit, what should the administrator create to let Alex restart one VM and read its properties without giving broader permissions?

Accepted Answer

Create a custom role that includes only the required VM read and restart actions.. Option A is correct because Azure custom roles allow you to define granular permissions by specifying only the required actions in the `Actions` field of the role definition. For Alex to restart a VM (`Microsoft.Compute/virtualMachines/restart/action`) and read its properties (`Microsoft.Compute/virtualMachines/read`), a custom role with exactly these two actions provides the least-privilege access without granting broader permissions like VM write or delete.

Answer

Create an Azure Policy assignment that allows restart operations on the VM.

Answer

Apply a CanNotDelete lock to the VM resource.

Answer

Move the VM to a management group so the permissions become more specific.

Question 9

New Azure subscriptions are created every month. Production subscriptions require stricter governance than sandbox subscriptions, and central IT wants those rules to apply automatically to any future production subscription without reconfiguring each one. What should they set up?

Accepted Answer

A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.. Management groups allow you to build a hierarchy that reflects your organizational structure and apply governance policies (e.g., Azure Policy, RBAC) at the management group scope. By creating a 'Production' child management group under the root, any new subscription placed in that group automatically inherits the assigned policies and role assignments, eliminating the need to reconfigure each subscription individually.

Answer

Separate resource groups for production and sandbox workloads in each subscription.

Answer

A CanNotDelete lock on each subscription.

Answer

A custom role assigned to each subscription owner.

Question 10

A platform team runs an internal automation tool that must restart VMs and read network interface settings in one resource group. Built-in roles available to the team are broader than the access they want to grant. What should the administrator create?

Accepted Answer

A custom role with only the required compute and read permissions, assigned at the resource group scope.. Option A is correct because the team needs only specific actions (restart VMs and read network interface settings) within a single resource group. Creating a custom role with only the required compute and read permissions, assigned at the resource group scope, follows the principle of least privilege and avoids granting broader access than necessary. Built-in roles like Contributor or Network Contributor include extra permissions (e.g., write, delete) that are not needed.

Answer

The Contributor role assigned at the subscription scope.

Answer

The Reader role assigned at the resource group scope.

Answer

The Network Contributor role assigned at the resource group scope.

Question 11

Based on the exhibit, which lock should the administrator apply so resources can still be updated but cannot be deleted by mistake?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it allows all operations including updates and reads, but explicitly prevents deletion of the resource. This meets the requirement that resources can still be updated but cannot be deleted by mistake. Azure resource locks operate at the scope level and override any role-based permissions, ensuring that even users with Contributor or Owner roles cannot delete the resource while the lock is active.

Answer

ReadOnly lock

Answer

Subscription lock

Answer

Management group lock

Question 12

A company creates new Azure subscriptions every month. Central IT wants all production subscriptions to inherit the same governance baseline automatically, while sandbox subscriptions remain separate. What should the administrator implement?

Accepted Answer

Organize subscriptions under management groups and assign the baseline at the appropriate management group.. Management groups allow hierarchical organization of Azure subscriptions, enabling the assignment of Azure Policy and RBAC at the management group level. By placing all production subscriptions under a dedicated management group and assigning the governance baseline (e.g., Azure Policy initiatives) to that group, new subscriptions automatically inherit the baseline without manual intervention. Sandbox subscriptions remain separate by being placed in a different management group or at the root level without the baseline.

Answer

Apply all governance controls individually to each new subscription after it is created.

Answer

Use a resource lock on the subscription root.

Answer

Place all resources into one shared resource group per business unit.

Question 13

Based on the exhibit, where should the new subscription be placed so it inherits the production governance baseline automatically?

Accepted Answer

Place the subscription under Prod-MG.. Option A is correct because placing the new subscription under the Prod-MG management group ensures it automatically inherits the Azure Policy and RBAC assignments applied at that level. Management groups in Azure allow hierarchical governance, and any subscription within a management group inherits policies and role assignments from that group and all parent groups. This enables consistent enforcement of the production governance baseline without manual configuration.

Answer

Place the subscription under Sandbox-MG.

Answer

Create a resource group named Finance-Prod instead of assigning a management group.

Answer

Move the subscription to the tenant root and assign policies later.

Question 14

Based on the exhibit, where should the administrator assign the role so the contractor can start and stop virtual machines only in RG-App and nothing else?

Accepted Answer

Assign the role at the resource group scope for RG-App.. The contractor needs to manage virtual machines only within RG-App. Azure RBAC allows you to assign the Virtual Machine Contributor role at the resource group scope, which grants permissions to start and stop VMs within that specific resource group while preventing access to resources in other resource groups or at higher scopes. Assigning at the subscription or management group level would grant permissions across all resource groups, violating the principle of least privilege.

Answer

Assign the role at the subscription scope so it covers the contractor's work area.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role directly to one virtual machine only, because that is always the best scope.

Question 15

Three Azure VMs run the same scheduled script and must access both Storage and Key Vault. The team wants one identity that can be reused if a VM is rebuilt, and they do not want the identity tied to a single machine. What should the administrator create?

Accepted Answer

A user-assigned managed identity attached to all three virtual machines.. A user-assigned managed identity is the correct choice because it is an independent Azure resource that can be assigned to multiple VMs, persists independently of any single VM's lifecycle, and can be reused when a VM is rebuilt. This identity provides seamless authentication to both Storage and Key Vault without managing credentials, meeting the requirement for a reusable, non-machine-tied identity.

Answer

A system-assigned managed identity on each virtual machine.

Answer

A service principal with a certificate file copied to each VM.

Answer

A shared access signature for each storage account and Key Vault access policy.