AZ-104 Manage Azure Identities and Governance Practice Test 8 — 15 Questions

Question 1

An enterprise has 30 Azure subscriptions. Production subscriptions need a common baseline of allowed regions, required tags, and approved SKU rules, and any new production subscription must inherit those rules automatically. Sandbox subscriptions should follow a separate, lighter baseline. Which Azure construct should the team use to organize this governance model?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A management group hierarchy with separate production and sandbox branches.. Management groups allow you to build a hierarchy of Azure subscriptions and apply Azure Policy at the management group scope. By creating separate management group branches for production and sandbox, you can assign distinct policy sets (allowed regions, required tags, approved SKUs) to each branch, and any new subscription placed under the production branch will automatically inherit those baseline rules.

Answer

A separate resource group for each business unit inside every subscription.

Answer

A set of resource locks applied directly to critical resources in each subscription.

Answer

A single policy exemption applied at the tenant root.

Question 2

A team in RG-Apps must be able to start, stop, and deallocate virtual machines and read their properties. Built-in roles available to the team are broader than necessary. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at RG-Apps scope.. The team needs specific actions (start, stop, deallocate, read properties) that are a subset of the Virtual Machine Contributor role's permissions. Creating a custom role with only the required actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, Microsoft.Compute/virtualMachines/read, etc.) and assigning it at the RG-Apps scope provides least-privilege access without granting broader capabilities like creating or deleting VMs.

Answer

Assign Virtual Machine Contributor at the subscription scope.

Answer

Assign Reader and Virtual Machine Contributor together at the resource group scope.

Answer

Assign Owner at the resource group scope to avoid troubleshooting access issues.

Question 3

An organization has one Azure subscription with separate resource groups for Development and Operations. A contractor must start, stop, and read the properties of virtual machines only in RG-Operations. The contractor must not have access to virtual machines in RG-Development. Where should the role assignment be created?

Accepted Answer

At the RG-Operations resource group scope. Role assignments in Azure are inherited from higher scopes (management group, subscription, resource group) down to lower scopes. To grant the contractor the Virtual Machine Contributor role (or a custom role with start/stop/read permissions) only on VMs in RG-Operations and explicitly deny access to RG-Development, the assignment must be scoped to the RG-Operations resource group. Assigning at a higher scope (subscription or management group) would grant access to all resource groups, including RG-Development, violating the requirement.

Answer

At the subscription scope

Answer

At the management group scope

Answer

At an individual virtual machine scope

Question 4

A build server in an on-premises datacenter must deploy ARM templates to Azure. The automation must not use a human account password, and Microsoft Entra conditional access for device sign-in is not available because the server is outside Azure. The security team allows a non-human credential but wants the strongest practical option for this scenario. What should the administrator configure?

Accepted Answer

A service principal authenticated with a certificate.. A service principal authenticated with a certificate provides a non-human credential that does not require a human password and is the strongest practical option for an on-premises build server that cannot use managed identities (which are Azure-resource-scoped) or device-based conditional access. Certificate-based authentication for service principals uses asymmetric cryptography (X.509 certificates) with a private key stored securely on the build server, offering higher security than a client secret and meeting the requirement to avoid human account passwords.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity shared with the build server.

Answer

A resource lock on the target resource group to permit template deployment.

Question 5

A system-assigned managed identity is attached to an Azure VM to call Key Vault. The VM is frequently reimaged and sometimes redeployed to a different name during scale events, but the application must keep the same identity and secretless access. What should the administrator use instead?

Accepted Answer

A user-assigned managed identity associated with the workload.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently when VMs are reimaged or redeployed with different names. This allows the application to retain the same identity and secretless access to Key Vault without requiring manual reconfiguration or credential rotation.

Answer

A system-assigned managed identity on each newly deployed VM.

Answer

A shared storage account key placed in the VM custom script.

Answer

A policy exemption for the Key Vault access policy.

Question 6

An App Service application needs to read secrets from Azure Key Vault. The security team does not want any password, certificate, or client secret stored in application settings, and they want the identity removed automatically if the app is deleted. What should the administrator enable?

Accepted Answer

A system-assigned managed identity on the App Service.. A system-assigned managed identity (Option B) is the correct choice because it provides an identity for the App Service that is automatically managed by Azure, tied to the lifecycle of the resource (deleted when the app is deleted), and requires no credentials to be stored in application settings. This allows the app to authenticate to Key Vault using Microsoft Entra ID tokens without any secrets, satisfying the security team's requirements.

Answer

A service principal with a client secret stored in App Service configuration.

Answer

A user-assigned managed identity shared by all applications.

Answer

A shared access signature stored in Key Vault.

Question 7

A VM-hosted automation tool must call Azure Resource Manager APIs, but the team will not store a password, certificate, or client secret on the VM. The identity should also disappear automatically when the VM is deleted. Which identity should be assigned?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM—when the VM is deleted, the identity is automatically removed. It allows the automation tool to authenticate to Azure Resource Manager APIs without storing any credentials (password, certificate, or client secret) on the VM, using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature

Question 8

Based on the exhibit, a policy assigned at the subscription denies storage accounts that allow public network access. One existing storage account in RG-Legacy must remain publicly reachable for 30 days while a migration is completed. What should the administrator use?

Accepted Answer

Create a policy exemption for stlegacy01 at the resource scope.. A policy exemption at the resource scope is the correct approach because it allows the administrator to selectively exclude the specific storage account (stlegacy01) from the subscription-level policy that denies public network access. This exemption can be configured with an expiration date of 30 days, ensuring the legacy account remains publicly reachable during the migration while the policy continues to apply to all other resources. Policy exemptions are designed for exactly this scenario—temporary exceptions for compliance or migration needs—without altering the policy definition or assignment.

Answer

Remove the policy assignment from the subscription until the migration finishes.

Answer

Change the policy effect from Deny to Audit.

Answer

Move the legacy storage account to a separate subscription and assign the policy there.

Question 9

A company has 18 Azure subscriptions. Production subscriptions must inherit stricter governance than sandbox subscriptions, and central IT wants one place to target future policy assignments to each group. What should the administrator do?

Accepted Answer

Create management groups for Prod and Sandbox, then move subscriptions into them. Management groups allow you to organize Azure subscriptions hierarchically and apply Azure Policy and role-based access control (RBAC) at the management group level, which is inherited by all subscriptions within that group. By creating separate management groups for Prod and Sandbox and moving the respective subscriptions into them, central IT can assign policy assignments once to each management group, ensuring stricter governance for production subscriptions and a lighter touch for sandbox subscriptions.

Answer

Create resource groups named Prod and Sandbox in each subscription

Answer

Use tags on subscriptions to separate production from sandbox

Answer

Apply a CanNotDelete lock to each subscription

Question 10

A policy assignment denies storage accounts unless public network access is disabled. One legacy storage account in a pilot resource group must remain publicly reachable for 60 days while the application team remediates dependencies. Compliance reporting must continue to show the policy as enforced everywhere else. What should the administrator do?

Accepted Answer

Use an Azure Policy exemption for that storage account. An Azure Policy exemption allows the administrator to exclude a specific scope (the legacy storage account) from the policy's effect while still reporting the policy as enforced on all other resources. The exemption can be set with an expiration date (60 days) to automatically remove the exception after the remediation period. This ensures compliance reporting continues to show the policy as active and enforced everywhere except the exempted resource.

Answer

Delete the policy assignment and re-create it later

Answer

Apply a read-only lock to the storage account

Answer

Assign a custom RBAC role to the application team

Question 11

Based on the exhibit, what should the administrator create to let Alex restart one VM and read its properties without giving broader permissions?

Accepted Answer

Create a custom role that includes only the required VM read and restart actions.. Azure custom roles allow you to define granular permissions by specifying only the required actions in the `Actions` field of the role definition. For Alex to restart a VM (`Microsoft.Compute/virtualMachines/restart/action`) and read its properties (`Microsoft.Compute/virtualMachines/read`), a custom role with exactly these two actions provides the least-privilege access without granting broader permissions like VM write or delete.

Answer

Create an Azure Policy assignment that allows restart operations on the VM.

Answer

Apply a CanNotDelete lock to the VM resource.

Answer

Move the VM to a management group so the permissions become more specific.

Question 12

New Azure subscriptions are created every month. Production subscriptions require stricter governance than sandbox subscriptions, and central IT wants those rules to apply automatically to any future production subscription without reconfiguring each one. What should they set up?

Accepted Answer

A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.. Management groups allow you to build a hierarchy that reflects your organizational structure and apply governance policies (e.g., Azure Policy, RBAC) at the management group scope. By creating a 'Production' child management group under the root, any new subscription placed in that group automatically inherits the assigned policies and role assignments, eliminating the need to reconfigure each subscription individually.

Answer

Separate resource groups for production and sandbox workloads in each subscription.

Answer

A CanNotDelete lock on each subscription.

Answer

A custom role assigned to each subscription owner.

Question 13

A platform team runs an internal automation tool that must restart VMs and read network interface settings in one resource group. Built-in roles available to the team are broader than the access they want to grant. What should the administrator create?

Accepted Answer

A custom role with only the required compute and read permissions, assigned at the resource group scope.. The team needs only specific actions (restart VMs and read network interface settings) within a single resource group. Creating a custom role with only the required compute and read permissions, assigned at the resource group scope, follows the principle of least privilege and avoids granting broader access than necessary. Built-in roles like Contributor or Network Contributor include extra permissions (e.g., write, delete) that are not needed.

Answer

The Contributor role assigned at the subscription scope.

Answer

The Reader role assigned at the resource group scope.

Answer

The Network Contributor role assigned at the resource group scope.

Question 14

Based on the exhibit, which lock should the administrator apply so resources can still be updated but cannot be deleted by mistake?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it allows all operations including updates and reads, but explicitly prevents deletion of the resource. This meets the requirement that resources can still be updated but cannot be deleted by mistake. Azure resource locks operate at the scope level and override any role-based permissions, ensuring that even users with Contributor or Owner roles cannot delete the resource while the lock is active.

Answer

ReadOnly lock

Answer

Subscription lock

Answer

Management group lock

Question 15

A company creates new Azure subscriptions every month. Central IT wants all production subscriptions to inherit the same governance baseline automatically, while sandbox subscriptions remain separate. What should the administrator implement?

Accepted Answer

Organize subscriptions under management groups and assign the baseline at the appropriate management group.. Management groups allow hierarchical organization of Azure subscriptions, enabling the assignment of Azure Policy and RBAC at the management group level. By placing all production subscriptions under a dedicated management group and assigning the governance baseline (e.g., Azure Policy initiatives) to that group, new subscriptions automatically inherit the baseline without manual intervention. Sandbox subscriptions remain separate by being placed in a different management group or at the root level without the baseline.

Answer

Apply all governance controls individually to each new subscription after it is created.

Answer

Use a resource lock on the subscription root.

Answer

Place all resources into one shared resource group per business unit.