AZ-104 Manage Azure Identities and Governance Practice Question
A deny policy blocks creation of storage accounts with public network access enabled. A legacy application in RG-Legacy must keep one existing storage account publicly reachable for 45 days while the rest of the subscription remains governed by the policy. What should the administrator configure?
⚠ Common exam trap
Watch out — candidates often confuse policy exemptions with role assignments or management locks, mistakenly thinking that granting Owner permissions or locking a resource can override a deny policy, when in fact only a policy exemption (or a policy exclusion at assignment scope) can bypass the deny effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A policy exemption at the RG-Legacy scope with an expiration date.
A policy exemption at the RG-Legacy scope with an expiration date is the correct solution because it allows the specific storage account to bypass the deny policy while keeping the policy enforced for all other resources. The exemption can be scoped to the resource group and set to expire in 45 days, ensuring the legacy application retains public access temporarily without permanently weakening the governance posture. This approach directly addresses the requirement to maintain compliance for the rest of the subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A policy exemption at the RG-Legacy scope with an expiration date.
Why this is correct
A policy exemption at the RG-Legacy scope with an expiration date temporarily waives the deny effect for new storage accounts created in that resource group while the original policy assignment remains active and enforced elsewhere. The expiration date forces a scheduled review, ensuring the exception does not persist indefinitely. This is the only construct that directly addresses the specific scope's non-compliance without altering the policy or permissions.
- ✗
A new role assignment that grants Owner on RG-Legacy.
Why it's wrong here
Assigning the Owner role on RG-Legacy grants full control over the resource group, but Azure Policy evaluation is independent of RBAC roles. A deny policy is enforced based on the policy assignment's scope and effect, not on the requesting identity's permissions; even an Owner holding the bypass role will still get a forbidden error. RBAC determines who can manage resources, but policy determines what actions are allowed, making this option ineffective.
When this WOULD be correct
If the question were about granting a user permissions to manage resources in a resource group (e.g., to deploy VMs) without any policy restrictions, assigning the Owner role at the RG scope would be correct.
- ✗
A management lock on the storage account.
Why it's wrong here
A management lock, such as CanNotDelete or ReadOnly, prevents accidental deletion or modification of a resource after it exists, but it does not influence Azure Policy's compliance evaluation or the deny effect during resource creation. Policy is enforced at deployment time before any lock can take effect, and a deny policy blocks the storage account from being created altogether. Therefore, a lock is simply an operational safeguard and not a mechanism to override governance rules.
When this WOULD be correct
A management lock would be correct if the question asked how to prevent accidental deletion or modification of a critical resource, such as a storage account that must be retained for compliance or audit purposes, without affecting policy compliance.
- ✗
A separate initiative assigned only to RG-Legacy with the deny setting disabled.
Why it's wrong here
A separate initiative assigned only to RG-Legacy with the deny setting disabled would create a relaxed policy baseline for that resource group, but it does not remove or exempt the original deny policy that still applies. This approach fragments the governance model by replacing the targeted exemption with a parallel policy setup, and it fails to record the exception with an expiration date. Unlike a policy exemption, it does not formally document the waiver or provide a controlled, auditable mechanism to bypass the deny effect.
When this WOULD be correct
This option would be correct if the question asked for a way to exclude an entire resource group from a policy for an indefinite period, such as when migrating a legacy application and needing to temporarily allow all resources in that group to bypass the policy without an expiration date.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A policy exemption at the RG-Legacy scope with an expiration date.Correct answer▾
Why this is correct
A policy exemption at the RG-Legacy scope with an expiration date temporarily waives the deny effect for new storage accounts created in that resource group while the original policy assignment remains active and enforced elsewhere. The expiration date forces a scheduled review, ensuring the exception does not persist indefinitely. This is the only construct that directly addresses the specific scope's non-compliance without altering the policy or permissions.
✗A new role assignment that grants Owner on RG-Legacy.Wrong answer — click to see why▾
Why this is wrong here
A role assignment granting Owner on RG-Legacy does not override a deny policy; deny policies take precedence over role assignments. The storage account would still be blocked by the policy.
★ When this WOULD be the correct answer
If the question were about granting a user permissions to manage resources in a resource group (e.g., to deploy VMs) without any policy restrictions, assigning the Owner role at the RG scope would be correct.
Why candidates choose this
Candidates may think that granting Owner rights allows bypassing policies, not realizing that deny policies explicitly override allow permissions.
✗A management lock on the storage account.Wrong answer — click to see why▾
Why this is wrong here
A management lock prevents accidental deletion or modification of the storage account, but it does not override a deny policy that blocks public network access. The lock cannot exempt the resource from policy enforcement.
★ When this WOULD be the correct answer
A management lock would be correct if the question asked how to prevent accidental deletion or modification of a critical resource, such as a storage account that must be retained for compliance or audit purposes, without affecting policy compliance.
Why candidates choose this
Candidates may confuse management locks with policy exemptions, thinking that locking the resource can protect it from policy enforcement, or they may believe that locks can override Azure Policy effects.
✗A separate initiative assigned only to RG-Legacy with the deny setting disabled.Wrong answer — click to see why▾
Why this is wrong here
A separate initiative assigned only to RG-Legacy with the deny setting disabled would remove the deny effect entirely for that resource group, but the question requires the deny policy to remain in effect for all other resources and only allow the existing storage account to be publicly reachable for 45 days. An initiative with the deny setting disabled would allow new storage accounts with public access to be created in RG-Legacy, which violates the policy intent.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a way to exclude an entire resource group from a policy for an indefinite period, such as when migrating a legacy application and needing to temporarily allow all resources in that group to bypass the policy without an expiration date.
Why candidates choose this
Candidates may think that assigning a separate initiative with the deny effect disabled is a clean way to exclude a resource group, but they overlook that policy exemptions are the proper mechanism for temporary exceptions with expiration, and that disabling the deny effect in an initiative would allow all resources in that scope to bypass the policy.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.