AZ-104 Manage Azure Identities and Governance Practice Test 9 — 15 Questions

Question 1

A support engineer must restart and view the properties of virtual machines only in RG-Dev. The engineer must not gain access to other resource groups in the subscription. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Dev scope.. The Virtual Machine Contributor role at the RG-Dev scope grants the engineer the necessary permissions to restart and view properties of virtual machines within that resource group, while restricting access to other resource groups. This role includes actions like Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/read, which cover the required tasks without granting broader management rights.

Answer

Assign the Reader role at the subscription scope and the Virtual Machine Contributor role at RG-Dev scope.

Answer

Assign the Contributor role at the RG-Dev scope.

Answer

Create a custom role at the subscription scope and assign it to the engineer.

Question 2

Several Azure VMs need the same Azure identity so they can access a shared resource without storing passwords. The identity should be reusable across VMs and removable centrally. Which identity type should the administrator use?

Accepted Answer

User-assigned managed identity. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs simultaneously, and can be centrally removed or updated without affecting the VMs themselves. This identity is reusable across VMs and eliminates the need to store passwords or secrets in code or configuration.

Answer

System-assigned managed identity

Answer

Service principal with a client secret

Answer

Local administrator account

Question 3

A shared resource group contains a VPN gateway and several virtual machines used by the finance department. Administrators must still be able to resize the VMs and update NSG rules, but no one should be able to delete the resource group or anything in it during the quarter-end freeze. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group. The CanNotDelete lock (option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as resizing VMs and modifying NSG rules. This meets the requirement to block deletions during the quarter-end freeze without hindering administrative changes. ReadOnly locks would block all write operations, including resizing and NSG rule updates, which is not desired.

Answer

ReadOnly lock on the resource group

Answer

Management group lock on the subscription

Answer

Azure Policy deny effect on the resource group

Question 4

Based on the exhibit, what should the administrator use to temporarily allow the legacy storage account to remain noncompliant without changing the policy for everyone?

Accepted Answer

Create a policy exemption for the legacy storage account or its resource group.. A policy exemption allows the administrator to exclude a specific resource (the legacy storage account) or its resource group from the Azure Policy evaluation without modifying the underlying policy definition. This is the correct approach because it temporarily grants noncompliance for that resource while the policy remains enforced for all other resources, aligning with the requirement to avoid changing the policy for everyone.

Answer

Modify the policy definition so all storage accounts can use public network access.

Answer

Apply a ReadOnly lock to the storage account.

Answer

Move the storage account to another subscription so the policy no longer applies.

Question 5

A company wants to stop users from creating resources in regions that are not approved and also require a Department tag on new resources. Which two tasks are best handled by Azure Policy? Select two.

Accepted Answer

Restrict allowed deployment locations.. Azure Policy can enforce organizational standards by evaluating resource properties against business rules. Option A is correct because the 'Allowed Locations' policy definition restricts users from deploying resources to any region not explicitly permitted, directly addressing the requirement to block unapproved regions. Option B is correct because the 'Require a tag and its value on resources' policy definition can enforce that a Department tag must exist on all new resources, ensuring compliance with tagging requirements.

Answer

Give users Contributor access to the subscription.

Answer

Create Microsoft Entra ID users for contractors.

Answer

Place a CanNotDelete lock on every resource group.

Question 6

A production storage account must remain available for updates, but administrators want to prevent accidental deletion during maintenance windows. Which lock should be applied to the storage account?

Accepted Answer

CanNotDelete lock at the storage account scope.. The CanNotDelete lock at the storage account scope prevents the storage account from being deleted while still allowing all read and update operations. This meets the requirement of keeping the storage account available for updates while preventing accidental deletion during maintenance windows.

Answer

ReadOnly lock at the storage account scope.

Answer

CanNotDelete lock at the subscription scope.

Answer

Azure Policy deny assignment on all storage account operations.

Question 7

A single Azure virtual machine must read blobs from a storage account without storing any passwords, keys, or connection strings. The identity should be removed automatically if the VM is deleted. Which option should you use?

Accepted Answer

System-assigned managed identity, because it is tied to that VM.. System-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any credentials, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS).

Answer

Storage account access key, because it is the simplest authentication method.

Answer

Shared access signature, because it always removes the need for identity management.

Answer

User-assigned managed identity, because it is deleted automatically with the VM.

Question 8

Based on the exhibit, which Azure Policy effect should be used so new resources without an Environment tag are blocked at deployment time?

Accepted Answer

Deny. The Deny effect (Option C) is the correct choice because it actively blocks any deployment that does not meet the policy rule—in this case, resources lacking an Environment tag. When a policy with Deny is assigned, Azure Resource Manager evaluates the request during deployment and rejects it with a 403 (Forbidden) status if the condition is not satisfied, preventing the resource from being created entirely.

Answer

Audit

Answer

Append

Answer

Disabled

Question 9

An operations team must apply three related policies to all subscriptions in a department: require a cost-center tag, allow only approved locations, and block certain VM SKUs. They want to assign and track these rules as one unit. What should they create?

Accepted Answer

An Azure Policy initiative.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for assignment and tracking as a single unit. By creating an initiative, the operations team can assign all three rules (cost-center tag, allowed locations, blocked VM SKUs) to all subscriptions in a department and track compliance at the initiative level, simplifying management and reporting.

Answer

A single Azure Policy definition containing all three rules.

Answer

A management group with no policy assignments.

Answer

An RBAC custom role with deny permissions.

Question 10

Based on the exhibit, which identity approach should be used so all three virtual machines can reuse the same Azure access without sharing secrets?

Accepted Answer

Use a user-assigned managed identity and attach it to all three VMs.. A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure VMs, allowing all three VMs to authenticate to Azure services (e.g., Azure Storage, Key Vault) using the same identity without sharing any secrets. This approach eliminates the need to manage or rotate credentials, as the identity is managed entirely by Azure AD and tokens are obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

Assign a system-assigned managed identity to each VM.

Answer

Create a storage account access key and place it in each VM's application settings.

Answer

Create a separate SAS token for each VM and rotate it manually.

Question 11

An operations team wants to label resources by Department and Environment so they can search and report on ownership across many resource groups. Which two statements are correct? Select two.

Accepted Answer

Tags are key-value pairs that can be applied to resources and resource groups.. Azure tags are indeed key-value pairs that can be applied to resources and resource groups. This allows the operations team to label resources with metadata like Department and Environment, enabling efficient searching, filtering, and reporting across multiple resource groups without affecting resource functionality.

Answer

A ReadOnly lock is the best way to record department ownership.

Answer

Tags automatically encrypt the data in a resource.

Answer

Tags replace Azure Policy when compliance must be enforced.

Question 12

Three application VMs in different resource groups must use the same Azure identity to read blobs from a storage account. The identity must continue to work if the VMs are redeployed. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be assigned to multiple VMs across different resource groups. It persists independently of the VM lifecycle, so it continues to work even if the VMs are redeployed, and it can be used to authenticate to Azure Storage for blob read operations via Azure AD.

Answer

A system-assigned managed identity on each VM

Answer

A shared access signature stored in a configuration file

Answer

The local Administrator account on each VM

Question 13

A service desk must grant and revoke access to an internal application for a changing group of employees. The service desk must not receive any Azure subscription or resource permissions. Which two actions should you take? Select two.

Accepted Answer

Use a Microsoft Entra security group to represent application access.. Using a Microsoft Entra security group creates a stable access boundary for the application, and making the service desk an owner lets them add or remove members without touching Azure RBAC. That is the least-privilege way to delegate access administration. It keeps resource permissions out of the model, avoids tenant-wide admin roles, and supports frequent employee changes cleanly through group membership updates.

Why others are wrong: Contributor on a resource group gives Azure resource control, not just membership administration. User Administrator is a directory-wide role and is too broad for one application group. Individual user assignments defeat the goal of delegated membership management and create ongoing maintenance. The correct pattern is group-based access with delegated ownership.

Answer

Assign the service desk the Contributor role on the application resource group.

Answer

Assign the service desk the User Administrator directory role to manage the application users.

Answer

Create individual user assignments for every employee instead of using group-based access.

Question 14

A web application is made up of several Azure resources that are deployed, updated, and retired together. The team wants one container for applying access control, tags, and deletion protection consistently to the whole application. What should they use?

Accepted Answer

A resource group.. A resource group is the correct container because it is a logical grouping of Azure resources that share the same lifecycle, allowing you to apply access control (RBAC), tags, and deletion protection (resource locks) consistently to all resources within the group. This aligns with the requirement to deploy, update, and retire resources together as a single unit.

Answer

A subscription dedicated to the application.

Answer

A management group.

Answer

A tag value that names the application.

Question 15

An external consultant from another company needs read-only access to a resource group and must sign in with their own work account. What should be created in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because a guest user account in Microsoft Entra ID (formerly Azure AD) allows an external user from another organization to sign in using their own work account (via B2B collaboration) and be granted read-only access to a specific resource group. This leverages the existing identity provider of the external consultant, eliminating the need to create a separate identity in the company tenant.

Answer

A member user account in the company tenant

Answer

A Microsoft 365 group

Answer

A service principal