AZ-104 Manage Azure Identities and Governance Practice Test 9 — 15 Questions

Question 1

Based on the exhibit, where should the new subscription be placed so it inherits the production governance baseline automatically?

Accepted Answer

Place the subscription under Prod-MG.. Placing the new subscription under the Prod-MG management group ensures it automatically inherits the Azure Policy and RBAC assignments applied at that level. Management groups in Azure allow hierarchical governance, and any subscription within a management group inherits policies and role assignments from that group and all parent groups. This enables consistent enforcement of the production governance baseline without manual configuration.

Answer

Place the subscription under Sandbox-MG.

Answer

Create a resource group named Finance-Prod instead of assigning a management group.

Answer

Move the subscription to the tenant root and assign policies later.

Question 2

Based on the exhibit, where should the administrator assign the role so the contractor can start and stop virtual machines only in RG-App and nothing else?

Accepted Answer

Assign the role at the resource group scope for RG-App.. The contractor needs to manage virtual machines only within RG-App. Azure RBAC allows you to assign the Virtual Machine Contributor role at the resource group scope, which grants permissions to start and stop VMs within that specific resource group while preventing access to resources in other resource groups or at higher scopes. Assigning at the subscription or management group level would grant permissions across all resource groups, violating the principle of least privilege.

Answer

Assign the role at the subscription scope so it covers the contractor's work area.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role directly to one virtual machine only, because that is always the best scope.

Question 3

Three Azure VMs run the same scheduled script and must access both Storage and Key Vault. The team wants one identity that can be reused if a VM is rebuilt, and they do not want the identity tied to a single machine. What should the administrator create?

Accepted Answer

A user-assigned managed identity attached to all three virtual machines.. A user-assigned managed identity is the correct choice because it is an independent Azure resource that can be assigned to multiple VMs, persists independently of any single VM's lifecycle, and can be reused when a VM is rebuilt. This identity provides seamless authentication to both Storage and Key Vault without managing credentials, meeting the requirement for a reusable, non-machine-tied identity.

Answer

A system-assigned managed identity on each virtual machine.

Answer

A service principal with a certificate file copied to each VM.

Answer

A shared access signature for each storage account and Key Vault access policy.

Question 4

A company wants to enforce three controls across all current and future subscriptions under a management group: allowed Azure regions, a required cost center tag, and approved VM SKUs. Central IT wants a single assignment and consolidated compliance reporting. What should they use?

Accepted Answer

One initiative assignment at the management group scope.. An initiative (policy set) at the management group scope allows you to bundle multiple policy definitions (allowed regions, required tag, approved VM SKUs) into a single assignment. This ensures the controls apply to all current and future subscriptions under that management group, and Azure Policy provides consolidated compliance reporting at the management group level, meeting the requirement for a single assignment and unified view.

Answer

Three separate policy assignments at each subscription scope.

Answer

A resource lock on the management group to prevent noncompliant deployments.

Answer

A custom RBAC role assigned to the management group.

Question 5

A support engineer must restart and view the properties of virtual machines only in RG-Dev. The engineer must not gain access to other resource groups in the subscription. What should the administrator do?

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Dev scope.. The Virtual Machine Contributor role at the RG-Dev scope grants the engineer the necessary permissions to restart and view properties of virtual machines within that resource group, while restricting access to other resource groups. This role includes actions like Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/read, which cover the required tasks without granting broader management rights.

Answer

Assign the Reader role at the subscription scope and the Virtual Machine Contributor role at RG-Dev scope.

Answer

Assign the Contributor role at the RG-Dev scope.

Answer

Create a custom role at the subscription scope and assign it to the engineer.

Question 6

Several Azure VMs need the same Azure identity so they can access a shared resource without storing passwords. The identity should be reusable across VMs and removable centrally. Which identity type should the administrator use?

Accepted Answer

User-assigned managed identity. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs simultaneously, and can be centrally removed or updated without affecting the VMs themselves. This identity is reusable across VMs and eliminates the need to store passwords or secrets in code or configuration.

Answer

System-assigned managed identity

Answer

Service principal with a client secret

Answer

Local administrator account

Question 7

A shared resource group contains a VPN gateway and several virtual machines used by the finance department. Administrators must still be able to resize the VMs and update NSG rules, but no one should be able to delete the resource group or anything in it during the quarter-end freeze. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group. The CanNotDelete lock (option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as resizing VMs and modifying NSG rules. This meets the requirement to block deletions during the quarter-end freeze without hindering administrative changes. ReadOnly locks would block all write operations, including resizing and NSG rule updates, which is not desired.

Answer

ReadOnly lock on the resource group

Answer

Management group lock on the subscription

Answer

Azure Policy deny effect on the resource group

Question 8

Based on the exhibit, what should the administrator use to temporarily allow the legacy storage account to remain noncompliant without changing the policy for everyone?

Accepted Answer

Create a policy exemption for the legacy storage account or its resource group.. A policy exemption allows the administrator to exclude a specific resource (the legacy storage account) or its resource group from the Azure Policy evaluation without modifying the underlying policy definition. This is the correct approach because it temporarily grants noncompliance for that resource while the policy remains enforced for all other resources, aligning with the requirement to avoid changing the policy for everyone.

Answer

Modify the policy definition so all storage accounts can use public network access.

Answer

Apply a ReadOnly lock to the storage account.

Answer

Move the storage account to another subscription so the policy no longer applies.

Question 9

A company wants to stop users from creating resources in regions that are not approved and also require a Department tag on new resources. Which two tasks are best handled by Azure Policy? Select two.

Accepted Answer

Restrict allowed deployment locations.. Azure Policy can enforce organizational standards by evaluating resource properties against business rules. Option A is correct because the 'Allowed Locations' policy definition restricts users from deploying resources to any region not explicitly permitted, directly addressing the requirement to block unapproved regions. Option B is correct because the 'Require a tag and its value on resources' policy definition can enforce that a Department tag must exist on all new resources, ensuring compliance with tagging requirements.

Answer

Give users Contributor access to the subscription.

Answer

Create Microsoft Entra ID users for contractors.

Answer

Place a CanNotDelete lock on every resource group.

Question 10

A production storage account must remain available for updates, but administrators want to prevent accidental deletion during maintenance windows. Which lock should be applied to the storage account?

Accepted Answer

CanNotDelete lock at the storage account scope.. The CanNotDelete lock at the storage account scope prevents the storage account from being deleted while still allowing all read and update operations. This meets the requirement of keeping the storage account available for updates while preventing accidental deletion during maintenance windows.

Answer

ReadOnly lock at the storage account scope.

Answer

CanNotDelete lock at the subscription scope.

Answer

Azure Policy deny assignment on all storage account operations.

Question 11

A single Azure virtual machine must read blobs from a storage account without storing any passwords, keys, or connection strings. The identity should be removed automatically if the VM is deleted. Which option should you use?

Accepted Answer

System-assigned managed identity, because it is tied to that VM.. System-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any credentials, using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS).

Answer

Storage account access key, because it is the simplest authentication method.

Answer

Shared access signature, because it always removes the need for identity management.

Answer

User-assigned managed identity, because it is deleted automatically with the VM.

Question 12

Based on the exhibit, which Azure Policy effect should be used so new resources without an Environment tag are blocked at deployment time?

Accepted Answer

Deny. The Deny effect (Option C) is the correct choice because it actively blocks any deployment that does not meet the policy rule—in this case, resources lacking an Environment tag. When a policy with Deny is assigned, Azure Resource Manager evaluates the request during deployment and rejects it with a 403 (Forbidden) status if the condition is not satisfied, preventing the resource from being created entirely.

Answer

Audit

Answer

Append

Answer

Disabled

Question 13

An operations team must apply three related policies to all subscriptions in a department: require a cost-center tag, allow only approved locations, and block certain VM SKUs. They want to assign and track these rules as one unit. What should they create?

Accepted Answer

An Azure Policy initiative.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for assignment and tracking as a single unit. By creating an initiative, the operations team can assign all three rules (cost-center tag, allowed locations, blocked VM SKUs) to all subscriptions in a department and track compliance at the initiative level, simplifying management and reporting.

Answer

A single Azure Policy definition containing all three rules.

Answer

A management group with no policy assignments.

Answer

An RBAC custom role with deny permissions.

Question 14

Based on the exhibit, which identity approach should be used so all three virtual machines can reuse the same Azure access without sharing secrets?

Accepted Answer

Use a user-assigned managed identity and attach it to all three VMs.. A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure VMs, allowing all three VMs to authenticate to Azure services (e.g., Azure Storage, Key Vault) using the same identity without sharing any secrets. This approach eliminates the need to manage or rotate credentials, as the identity is managed entirely by Microsoft Entra ID and tokens are obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

Assign a system-assigned managed identity to each VM.

Answer

Create a storage account access key and place it in each VM's application settings.

Answer

Create a separate SAS token for each VM and rotate it manually.

Question 15

An operations team wants to label resources by Department and Environment so they can search and report on ownership across many resource groups. Which two statements are correct? Select two.

Accepted Answer

Tags are key-value pairs that can be applied to resources and resource groups.. Azure tags are indeed key-value pairs that can be applied to resources and resource groups. This allows the operations team to label resources with metadata like Department and Environment, enabling efficient searching, filtering, and reporting across multiple resource groups without affecting resource functionality.

Answer

A ReadOnly lock is the best way to record department ownership.

Answer

Tags automatically encrypt the data in a resource.

Answer

Tags replace Azure Policy when compliance must be enforced.