AZ-104 Refer to the Exhibit Practice Questions

Explanation: Azure RBAC assignments inherit from higher scopes to lower scopes. If the requirement is to grant read access across every current and future subscription under a management group, the management group is the correct place to assign the role. That avoids repeated work and ensures inheritance applies automatically to all child subscriptions, resource groups, and resources beneath Corp. Why others are wrong: A is limited to one resource group and misses the rest of the management group. C would work, but it is not the best administrative choice because every new subscription would need another assignment. D is far too narrow and would require many separate assignments, which defeats centralized governance.

Explanation: The requirement is to keep deployments flowing while automatically adding the CostCenter tag. Modify is the policy effect designed to alter the request and apply the missing tag. That makes it more suitable than deny or audit because it enforces the standard without stopping the deployment. It is also the right choice when the goal is automatic correction rather than just reporting noncompliance. Why others are wrong: A blocks deployments and contradicts the requirement. B only reports the issue and leaves the tag missing. C is not the strongest fit for automatic tag correction in this scenario; the question asks for the effect that best matches ongoing remediation behavior.

Explanation: The Custom Script Extension is the best choice because it runs commands or scripts inside the guest operating system after the VM is provisioned. It is commonly used for simple automation tasks such as installing IIS, applying configuration files, or preparing an application server. Because it runs without an interactive session, it fits the requirement to automate setup immediately after deployment. Why others are wrong: Azure Policy can govern configuration, but it does not execute guest scripts. An availability set is only a placement and resiliency feature. A private endpoint is for securing network access to Azure services, not for provisioning software on a VM.

Explanation: When only a single file is missing, the right Azure Backup approach is file recovery from an existing recovery point. The exhibit shows there are restore points available, so you can mount the recovery point and copy back the deleted file. This avoids restoring the whole VM, which would be slower and more disruptive than necessary. Why others are wrong: Restoring the entire VM is excessive for a single deleted file. Changing the backup policy affects future protection, not the current loss. Azure Monitor alerts are not a restore mechanism and cannot recover file content. The scenario asks for the smallest effective recovery action, which is file-level recovery.

Explanation: Resource group deletion is an administrative event that appears in AzureActivity. Because the team already exports activity logs to Log Analytics, the right solution is a log alert built from a KQL query. The query can filter on the delete operation and exclude events where the caller is the trusted automation account, ensuring the alert is both accurate and actionable. Why others are wrong: A CPU metric alert is unrelated to administrative changes. Diagnostic settings are not the issue because the activity log is already being collected. Azure Policy governs compliance and deployment behavior, but it does not replace log-based detection of past events.