AZ-104 Manage Azure Identities and Governance Practice Test 7 — 15 Questions

Question 1

A build server hosted in a company datacenter must deploy ARM templates to a target resource group in Azure without storing a user password. The server is not running in Azure, and the team wants to authorize deployments with Azure RBAC. What should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A service principal authenticated with a certificate and assigned RBAC on the target scope. A service principal authenticated with a certificate is the correct approach because it allows non-Azure resources (like an on-premises build server) to authenticate to Azure without storing a user password. The certificate-based authentication satisfies the requirement to avoid storing a password, and assigning RBAC on the target resource group grants the service principal the necessary permissions to deploy ARM templates. This method is secure, supports automation, and aligns with Azure AD application registration best practices.

Answer

A system-assigned managed identity on the build server

Answer

A personal user account with multifactor authentication

Answer

A shared access signature for the resource group

Question 2

Based on the exhibit, a shared resource group contains a production virtual machine and a storage account. Administrators must be able to update settings, but they must not be able to delete either resource by mistake. Which lock should be applied at the resource group scope?

Accepted Answer

CanNotDelete lock, because it allows updates but blocks deletion.. The CanNotDelete lock (option B) is correct because it allows administrators to update settings on the production VM and storage account while preventing accidental deletion of either resource. This lock operates at the resource group scope, applying to all resources within it, and is the appropriate choice for the stated requirement of allowing updates but blocking deletions.

Answer

ReadOnly lock, because it prevents all changes and keeps resources fully protected.

Answer

No lock is needed because Azure RBAC already prevents deletion by default.

Answer

Management group lock, because all changes in the tenant must be blocked centrally.

Question 3

Based on the exhibit, which identity type should be used so the on-premises build server can authenticate to Azure without using a human account password?

Accepted Answer

Service principal. A service principal is the correct identity type for an on-premises build server to authenticate to Azure without a human account password because it represents a non-human identity that can be assigned to applications, services, and automation tools. Service principals authenticate using client secrets or certificates, enabling secure, password-less authentication via OAuth 2.0 client credentials grant flow, which is ideal for automated build pipelines.

Answer

System-assigned managed identity

Answer

User-assigned managed identity

Answer

Azure Storage access key

Question 4

A policy at the management group denies storage accounts that allow public network access. One legacy storage account in RG-Legacy must stay public for 30 days while a migration runs, and the team does not want to change the policy for everyone else. What should the administrator create?

Accepted Answer

A policy exemption for that storage account. A policy exemption allows specific resources to be excluded from the effect of a policy initiative without modifying the original policy definition. In this scenario, the management group policy denies storage accounts with public network access, but the legacy account needs to remain public temporarily. By creating a policy exemption (with 'exempt' category) for that specific storage account, the administrator can bypass the deny effect for 30 days while the policy continues to apply to all other resources.

Answer

A resource lock on the storage account

Answer

A second policy assignment with higher priority

Answer

A custom RBAC role for the migration team

Question 5

A scheduled script runs on several Azure VMs. The VMs are rebuilt often, and the script must always use the same Azure identity across every rebuild without storing secrets on disk. Which two steps should the administrator take? Select two.

Accepted Answer

Create a user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is an Azure identity that exists independently of any VM and can be assigned to multiple VMs. When a VM is rebuilt, you simply assign the same user-assigned identity to the new VM, and the script can authenticate using the identity's client ID without storing any secrets on disk. This ensures the script always uses the same identity across rebuilds, as the identity's credentials are managed entirely by Azure and rotated automatically.

Answer

Use a system-assigned managed identity on one VM and clone it.

Answer

Store a service principal secret in the script configuration.

Answer

Use a shared access signature to authenticate to Azure Resource Manager.

Question 6

An enterprise wants to enforce three governance controls for all subscriptions under a management group: allowed locations, required tags, and permitted VM sizes. The team wants a single place to assign and track compliance for all three controls. What should the administrator use?

Accepted Answer

One policy initiative assigned at the management group. A policy initiative (also known as a policy set) allows you to group multiple policy definitions (e.g., allowed locations, required tags, permitted VM sizes) into a single, reusable package. Assigning this initiative at the management group level enforces all three governance controls across every subscription under that management group, providing a single place to assign and track compliance via Azure Policy's compliance dashboard.

Answer

Three separate policy assignments at each subscription

Answer

A custom RBAC role assigned to each subscription

Answer

A resource lock on each subscription

Question 7

A scheduled script runs on several Azure virtual machines that are created and replaced over time. The script must use the same Azure identity on every VM, and the identity should continue to exist even if one VM is deleted and recreated. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity is the correct choice because it is an Azure resource that exists independently of any VM, and it can be attached to multiple VMs. When a VM is deleted and recreated, the same user-assigned managed identity can be reattached, ensuring the script uses the same identity consistently. This decouples the identity lifecycle from the VM lifecycle, meeting the requirement for persistence across VM replacements.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal with a client secret stored in each VM.

Answer

A shared access signature stored in the VM registry.

Question 8

Based on the exhibit, the governance team wants to assign three related policy definitions together: allowed regions, required tags, and approved VM SKUs. What should the administrator create first?

Accepted Answer

A policy initiative that groups the three policy definitions into one object.. A policy initiative (also known as a policy set) is the correct answer because it allows you to group multiple related policy definitions into a single assignable object. This is the intended Azure governance pattern for bundling policies like allowed regions, required tags, and approved VM SKUs, ensuring they are applied together consistently across management groups or subscriptions.

Answer

A resource lock so the policies cannot be changed after assignment.

Answer

A custom RBAC role that grants permission to edit policy assignments.

Answer

A management group exemption so all three rules apply automatically.

Question 9

Based on the exhibit, an auditor needs to view all resources in RG-Finance but must not be able to make any changes. The auditor also should not have access to other resource groups. Which RBAC assignment best meets the requirement?

Accepted Answer

Reader at RG-Finance scope, because it allows viewing without granting write permissions.. The Reader role at the RG-Finance scope grants read-only access to all resources within that specific resource group, preventing any modifications. This meets the auditor's requirement to view resources in RG-Finance without write permissions and without access to other resource groups, as the scope is limited to RG-Finance.

Answer

Reader at the subscription scope, because it is read-only and easy to manage.

Answer

Contributor at RG-Finance scope, because the auditor needs to read tags and configuration.

Answer

Reader at the management group scope, because all finance resources are grouped there.

Question 10

Two Azure virtual machines run the same automation script and both need access to Key Vault and Storage. The script must keep working if one VM is redeployed, and the team wants the same identity to be usable by both VMs. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to both VMs. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. This ensures both VMs share the same identity for accessing Key Vault and Storage, and the identity persists independently of any single VM's lifecycle, so redeploying one VM does not break access for the other.

Answer

A system-assigned managed identity on each VM

Answer

A service principal stored in a configuration file on the VMs

Answer

A storage account access key stored in the script

Question 11

Based on the exhibit, which identity should the administrator enable to remove the secret from app settings and have the identity disappear automatically when the app is deleted?

Accepted Answer

System-assigned managed identity. The system-assigned managed identity is tied directly to the lifecycle of the Azure resource (e.g., an App Service). When you enable it, Azure automatically creates a service principal in Azure AD for that resource, and you can use the identity to access Azure Key Vault without storing secrets in app settings. When the resource is deleted, the system-assigned managed identity and its corresponding service principal are automatically removed, eliminating the need for manual cleanup.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature

Question 12

An enterprise has 30 Azure subscriptions. Production subscriptions need a common baseline of allowed regions, required tags, and approved SKU rules, and any new production subscription must inherit those rules automatically. Sandbox subscriptions should follow a separate, lighter baseline. Which Azure construct should the team use to organize this governance model?

Accepted Answer

A management group hierarchy with separate production and sandbox branches.. Management groups allow you to build a hierarchy of Azure subscriptions and apply Azure Policy at the management group scope. By creating separate management group branches for production and sandbox, you can assign distinct policy sets (allowed regions, required tags, approved SKUs) to each branch, and any new subscription placed under the production branch will automatically inherit those baseline rules.

Answer

A separate resource group for each business unit inside every subscription.

Answer

A set of resource locks applied directly to critical resources in each subscription.

Answer

A single policy exemption applied at the tenant root.

Question 13

A team in RG-Apps must be able to start, stop, and deallocate virtual machines and read their properties. Built-in roles available to the team are broader than necessary. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at RG-Apps scope.. The team needs specific actions (start, stop, deallocate, read properties) that are a subset of the Virtual Machine Contributor role's permissions. Creating a custom role with only the required actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, Microsoft.Compute/virtualMachines/read, etc.) and assigning it at the RG-Apps scope provides least-privilege access without granting broader capabilities like creating or deleting VMs.

Answer

Assign Virtual Machine Contributor at the subscription scope.

Answer

Assign Reader and Virtual Machine Contributor together at the resource group scope.

Answer

Assign Owner at the resource group scope to avoid troubleshooting access issues.

Question 14

An organization has one Azure subscription with separate resource groups for Development and Operations. A contractor must start, stop, and read the properties of virtual machines only in RG-Operations. The contractor must not have access to virtual machines in RG-Development. Where should the role assignment be created?

Accepted Answer

At the RG-Operations resource group scope. Role assignments in Azure are inherited from higher scopes (management group, subscription, resource group) down to lower scopes. To grant the contractor the Virtual Machine Contributor role (or a custom role with start/stop/read permissions) only on VMs in RG-Operations and explicitly deny access to RG-Development, the assignment must be scoped to the RG-Operations resource group. Assigning at a higher scope (subscription or management group) would grant access to all resource groups, including RG-Development, violating the requirement.

Answer

At the subscription scope

Answer

At the management group scope

Answer

At an individual virtual machine scope

Question 15

A build server in an on-premises datacenter must deploy ARM templates to Azure. The automation must not use a human account password, and Microsoft Entra conditional access for device sign-in is not available because the server is outside Azure. The security team allows a non-human credential but wants the strongest practical option for this scenario. What should the administrator configure?

Accepted Answer

A service principal authenticated with a certificate.. A service principal authenticated with a certificate provides a non-human credential that does not require a human password and is the strongest practical option for an on-premises build server that cannot use managed identities (which are Azure-resource-scoped) or device-based conditional access. Certificate-based authentication for service principals uses asymmetric cryptography (X.509 certificates) with a private key stored securely on the build server, offering higher security than a client secret and meeting the requirement to avoid human account passwords.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity shared with the build server.

Answer

A resource lock on the target resource group to permit template deployment.