AZ-104 Manage Azure Identities and Governance Practice Test 9 — 15 Questions

Question 1

A service desk must grant and revoke access to an internal application for a changing group of employees. The service desk must not receive any Azure subscription or resource permissions. Which two actions should you take? Select two.

Accepted Answer

Use a Microsoft Entra security group to represent application access.. Using a Microsoft Entra security group creates a stable access boundary for the application, and making the service desk an owner lets them add or remove members without touching Azure RBAC. That is the least-privilege way to delegate access administration. It keeps resource permissions out of the model, avoids tenant-wide admin roles, and supports frequent employee changes cleanly through group membership updates.

Why others are wrong: Contributor on a resource group gives Azure resource control, not just membership administration. User Administrator is a directory-wide role and is too broad for one application group. Individual user assignments defeat the goal of delegated membership management and create ongoing maintenance. The correct pattern is group-based access with delegated ownership.

Answer

Assign the service desk the Contributor role on the application resource group.

Answer

Assign the service desk the User Administrator directory role to manage the application users.

Answer

Create individual user assignments for every employee instead of using group-based access.

Question 2

A web application is made up of several Azure resources that are deployed, updated, and retired together. The team wants one container for applying access control, tags, and deletion protection consistently to the whole application. What should they use?

Accepted Answer

A resource group.. A resource group is the correct container because it is a logical grouping of Azure resources that share the same lifecycle, allowing you to apply access control (RBAC), tags, and deletion protection (resource locks) consistently to all resources within the group. This aligns with the requirement to deploy, update, and retire resources together as a single unit.

Answer

A subscription dedicated to the application.

Answer

A management group.

Answer

A tag value that names the application.

Question 3

An external consultant from another company needs read-only access to a resource group and must sign in with their own work account. What should be created in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because a guest user account in Microsoft Entra ID (formerly Azure AD) allows an external user from another organization to sign in using their own work account (via B2B collaboration) and be granted read-only access to a specific resource group. This leverages the existing identity provider of the external consultant, eliminating the need to create a separate identity in the company tenant.

Answer

A member user account in the company tenant

Answer

A Microsoft 365 group

Answer

A service principal

Question 4

Based on the exhibit, which identity should be granted the Contributor role so access can be managed centrally as team members change?

Accepted Answer

Assign Contributor to a Microsoft Entra security group that contains the team members.. Assigning the Contributor role to a Microsoft Entra security group that contains the team members allows access to be managed centrally. As team members join or leave, you simply add or remove them from the group, and their permissions update automatically without needing to modify role assignments for each individual user. This aligns with Azure RBAC best practices for centralized identity governance.

Answer

Assign Contributor to each user account individually.

Answer

Assign Contributor to a managed identity.

Answer

Assign Contributor to the management group that contains rg-app.

Question 5

A company has many subscriptions arranged under a management group named Corp. The audit team needs Reader access to every current and future subscription in Corp, and the administrator wants only one role assignment to maintain. Which two actions should be taken? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope grants read-only access to all current and future subscriptions within that management group. This is because Azure RBAC roles assigned at a management group are inherited by all child subscriptions, eliminating the need for individual assignments. This approach satisfies the requirement of a single role assignment that covers all subscriptions.

Answer

Assign Reader separately on each subscription.

Answer

Assign Reader at the tenant root and remove the management group.

Answer

Create a resource group for each subscription and assign Reader there.

Question 6

A project team adds and removes contractors every few weeks. The team needs Azure access to follow membership changes without updating role assignments for each person. What should the administrator use to delegate the access?

Accepted Answer

Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.. Option B is correct because assigning an Azure role to a Microsoft Entra security group allows the administrator to manage access by simply adding or removing contractors from the group, without needing to update role assignments for each individual. This leverages Azure RBAC's support for group-based assignments, which automatically propagate role permissions to new members and revoke them from removed members.

Answer

Assign the Azure role directly to each contractor user account.

Answer

Use a Microsoft 365 group and assign the Azure role to it.

Answer

Create a management group for the contractors and assign the role there.

Question 7

A department has 12 subscriptions under a management group named Corp. New resources must be deployed only in East US or West US and must include a CostCenter tag. A pilot subscription must be exempt from these rules during testing. Which two actions should you take? Select two.

Accepted Answer

Assign an initiative containing both policy definitions at the Corp management-group scope.. Option A is correct because assigning an initiative (a collection of policy definitions) at the Corp management-group scope ensures that all 12 subscriptions inherit both the location restriction and the CostCenter tag requirement. This is the most efficient and scalable way to enforce governance across multiple subscriptions without repeating assignments.

Answer

Assign the policies individually at each resource group.

Answer

Use the Owner role at the management-group scope.

Answer

Use a resource lock instead of Azure Policy.

Question 8

Based on the exhibit, where should the Network Contributor role be assigned so the engineer can manage only VNet-vm and its subnets, but not other resources in rg-platform?

Accepted Answer

Assign Network Contributor at the VNet-vm resource scope.. Option D is correct because assigning the Network Contributor role at the VNet-vm resource scope grants the engineer permissions to manage only that specific virtual network and its subnets, while preventing any access to other resources within the rg-platform resource group. This follows the principle of least privilege by scoping the role assignment to the exact resource that needs to be managed.

Answer

Assign Network Contributor at the management group scope.

Answer

Assign Network Contributor at the subscription scope.

Answer

Assign Network Contributor at the resource group scope for rg-platform.

Question 9

A contractor pool changes every month. The operations team wants Azure role access to stay the same when people join or leave, without editing role assignments for each person. Which two actions should the administrator take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the contractor pool.. Option A is correct because creating a security group in Microsoft Entra ID (formerly Azure AD) allows the administrator to manage membership dynamically or manually as contractors join or leave. By assigning the Azure role to this security group (Option D), role assignments remain constant; only group membership changes, eliminating the need to edit individual role assignments. This approach leverages Azure RBAC's support for security groups as assignable principals, ensuring consistent access control.

Answer

Assign the Azure role directly to each contractor account.

Answer

Create a Microsoft 365 group and use it for VM sign-in.

Answer

Use a user-assigned managed identity for each contractor.

Question 10

Based on the exhibit, which Azure feature should the administrator add so ownership and chargeback information remains visible even if resources are moved between resource groups?

Accepted Answer

Tags. Tags are metadata key-value pairs that can be assigned to Azure resources and resource groups. They persist even when resources are moved between resource groups, making them ideal for tracking ownership and chargeback information across organizational boundaries. Unlike other options, tags are specifically designed for cost tracking, ownership attribution, and resource categorization.

Answer

Management groups

Answer

Resource locks

Answer

Role assignments

Question 11

A company wants to group several subscriptions for Finance, HR, and Engineering so that the same governance settings can be applied above the subscription level. What should the administrator create?

Accepted Answer

A management group. A management group is the correct choice because it allows you to organize multiple Azure subscriptions into a hierarchy and apply governance policies, role-based access control (RBAC), and compliance settings at a scope above the subscription level. By creating a management group for Finance, HR, and Engineering, the administrator can enforce consistent Azure Policy initiatives and RBAC assignments across all three subscriptions, ensuring uniform governance without needing to configure each subscription individually.

Answer

A resource group

Answer

A tag

Answer

A resource lock

Question 12

A contractor must manage only VM1 and VM2 in rg-prod. The contractor must not be able to manage any other resource in the resource group. Which two role assignment scopes should you create? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Assigning the role at the VM1 resource scope (Option A) is correct because Azure RBAC allows you to scope a role assignment to an individual resource, such as a virtual machine. This grants the contractor permissions to manage only VM1, without affecting any other resources in the resource group. The same logic applies to VM2, making the resource-level scope the precise way to restrict management to just those two VMs.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 13

A production resource group must not be deleted accidentally, but administrators still need to update resources inside it. Which lock should you apply to the resource group?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it prevents deletion of the resource group while still allowing all other operations, including updates to resources within it. This lock type is specifically designed to protect against accidental deletion without blocking read, write, or modify actions, which aligns perfectly with the requirement that administrators need to update resources inside the group.

Answer

ReadOnly lock

Answer

Contributor role

Answer

Azure Policy deny assignment

Question 14

A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?

Accepted Answer

At the rg-finance-app resource group scope.. The Contributor role must be assigned at the rg-finance-app resource group scope to restrict permissions exclusively to that group. This ensures the team can manage only the resources within that resource group, without inheriting permissions to other resource groups in the subscription. Role assignments in Azure are inherited from higher scopes (management group, subscription) down to lower scopes, so assigning at the resource group scope is the most specific and restrictive level that meets the requirement.

Answer

At the management group that contains the subscription.

Answer

At the subscription scope.

Answer

At each individual resource in the resource group.

Question 15

A company wants to stop users from deploying resources in any region except East US and West US. Users still need to be able to create resources if they choose an approved region. Which Azure feature should the administrator use?

Accepted Answer

Azure Policy with a deny effect assigned at the appropriate scope.. Azure Policy with a deny effect can enforce that resource deployments are only allowed in specified regions (East US and West US) by evaluating the location property of the resource against a policy definition. When a user attempts to deploy a resource in a non-approved region, the policy engine rejects the request before any resource creation begins, ensuring compliance without blocking approved regions.

Answer

Azure RBAC with a Contributor role at the subscription scope.

Answer

A resource lock at the subscription level.

Answer

A tag requirement in Azure RBAC.