AZ-104 Manage Azure Identities and Governance Practice Question
A user had a direct Reader assignment on a virtual machine, but that assignment was removed. The user can still open the VM blade and view its properties. Which two sources could still be granting access? Select two.
⚠ Common exam trap
It's easy for candidates to confuse resource locks (like CanNotDelete) with RBAC permissions, or think that Azure Policy or networking constructs (like private endpoints) can grant access, when in fact only role assignments (direct or inherited) control access to Azure resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.
Azure RBAC permissions are inherited from higher scopes. Even if a direct Reader assignment on the VM is removed, a Reader role assigned at the parent resource group, subscription, or management group scope will still grant the user read access to the VM through inheritance. This is a fundamental behavior of Azure RBAC, where permissions flow down the hierarchy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.
Why this is correct
RBAC inheritance flows downward from management group to subscription to resource group to resource. A broader-scope Reader assignment would still allow the user to view the VM even after the direct VM-level assignment was removed. This is the most common reason access appears to persist.
- ✓
Membership in an Entra security group that has Reader at an inherited scope can still provide visibility to the VM.
Why this is correct
Role assignments can be granted to groups, and users inherit the permissions of their group memberships. If the security group has Reader at the subscription or resource-group scope, the user will still be able to view the VM. This often surprises administrators who check only direct assignments.
- ✗
A CanNotDelete lock on the VM is granting the user permission to view it.
Why it's wrong here
An Azure resource lock, such as CanNotDelete, is a protection mechanism that blocks certain management operations for users who already hold the necessary RBAC permissions; it never grants access. Read visibility of a virtual machine requires the Microsoft.Compute/virtualMachines/read action, which comes from a role assignment, not from a lock. Removing a direct Reader assignment reveals that the user must have another role assignment elsewhere, because locks are evaluated only after a user has been authorized and cannot produce a resource blade in the portal.
When this WOULD be correct
If the question asked 'Which Azure feature prevents accidental deletion of a resource?' then a CanNotDelete lock would be the correct answer.
- ✗
An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.
Why it's wrong here
Azure Policy with an audit effect evaluates configuration against compliance rules and writes results to the activity log or compliance data, but it does not issue an access token or add role assignments. The audit effect is implemented as a background service and requires no user identity; therefore it cannot make a VM visible to anyone. Portal visibility for a specific user is determined solely by RBAC actions such as Microsoft.Compute/virtualMachines/read, so a policy assignment is irrelevant to why access persisted.
When this WOULD be correct
If the question asked which Azure feature can be used to audit resource configurations without granting access, Azure Policy would be correct. For example: 'Which Azure service can evaluate VM compliance without granting read permissions?'
- ✗
A private endpoint connected to the VM subnet is providing inherited read permission through networking.
Why it's wrong here
Private endpoints affect network reachability for supported services; they do not authorize Azure portal access to compute resources. A VM blade being visible is an RBAC issue, not a private networking issue. The option is unrelated to the symptom.
When this WOULD be correct
If the question were about granting network-level access to a VM without exposing it to the public internet, a private endpoint would be the correct answer. For example: 'Which Azure resource allows a VM to be accessed securely from a virtual network without a public IP?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.Correct answer▾
Why this is correct
RBAC inheritance flows downward from management group to subscription to resource group to resource. A broader-scope Reader assignment would still allow the user to view the VM even after the direct VM-level assignment was removed. This is the most common reason access appears to persist.
✗A CanNotDelete lock on the VM is granting the user permission to view it.Wrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock prevents deletion but does not grant any read permissions; RBAC roles control access, not locks.
★ When this WOULD be the correct answer
If the question asked 'Which Azure feature prevents accidental deletion of a resource?' then a CanNotDelete lock would be the correct answer.
Why candidates choose this
Candidates may confuse locks with access control, thinking that a lock that prevents deletion also implies permission to view the resource.
✗An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy assignments do not grant RBAC permissions; they enforce compliance rules. Auditing a VM does not provide read access to the resource.
★ When this WOULD be the correct answer
If the question asked which Azure feature can be used to audit resource configurations without granting access, Azure Policy would be correct. For example: 'Which Azure service can evaluate VM compliance without granting read permissions?'
Why candidates choose this
Candidates may confuse Azure Policy's ability to evaluate resources with granting access, thinking that compliance evaluation implies read permissions.
✗A private endpoint connected to the VM subnet is providing inherited read permission through networking.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint provides network connectivity to a VM via a private IP, but it does not grant any Azure RBAC permissions. Read access is controlled by role assignments, not by networking components.
★ When this WOULD be the correct answer
If the question were about granting network-level access to a VM without exposing it to the public internet, a private endpoint would be the correct answer. For example: 'Which Azure resource allows a VM to be accessed securely from a virtual network without a public IP?'
Why candidates choose this
Candidates may confuse network connectivity with access control, thinking that a private endpoint, which enables private access, also implies read permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.