Microsoft AZ-104 Practice Test 11
Question 100
Operations wants a single view of Azure Backup jobs that have failed, together with protected-instance trends and actionable alerts. Which management approach best meets this?
- Configure Azure Backup monitoring, reporting and alerts for the relevant vaults
- Read only current VM CPU charts
- Enable anonymous access to storage accounts
- Change all management groups to a single tag
Explanation
Correct Answer
A:Azure Backup provides job status, reporting and alerting integrations that help identify failed backups and protection gaps. Confirm telemetry routing, permissions and alert recipients; review affected jobs rather than inferring success from policy existence.
Incorrect Answers
B:CPU charts can reveal compute stress but do not establish whether backup jobs succeeded or recovery points were retained.
C:Anonymous storage access weakens data security and does not surface backup job results. Recovery reporting is a monitoring configuration, not a public sharing requirement.
D:Management-group tags are unrelated to backup health and cannot consolidate vault job failures into a recovery operations view.
Question 101
The HR import creates a new cloud employee but the username suffix has not been verified in this tenant. What must be completed before using that suffix for the UPN?
- Check immutable employee identifiers and the exact Entra user object IDs before replaying writes.
- Inspect the enterprise application's User assignment required setting and its assigned users or groups.
- Assign explicit group owners and verify the group's membership model.
- Verify ownership of the custom domain in Microsoft Entra before assigning the UPN suffix.
Explanation
Correct Answer
D:Entra accepts custom sign-in domains after the administrator proves DNS ownership. Creating a DNS record alone without tenant verification cannot make the suffix available.
Incorrect Answers
A:Idempotent matching prevents a retry from creating a second principal for the same employee. Display names are not unique reliable keys.
B:When assignment is required, a valid guest credential alone is insufficient. Membership or explicit application assignment must authorize the target user.
C:Assigned and dynamic groups have different management methods. Group owners provide accountable delegated administration where supported.
Question 102
The directory shows the custom domain as Unverified even though an employee already uses the domain for email. What should be inspected?
- Check the domain verification TXT record at its authoritative public DNS host.
- Review inbound cross-tenant access settings for the partner's tenant ID.
- Check only the Exchange accepted-domain configuration and skip the requested Microsoft Entra domain-verification DNS record.
- Enable the relevant service plan within the product license assignment.
Explanation
Correct Answer
A:Entra tests the published verification challenge for the domain; an email address or an internal DNS entry does not prove the tenant controls the required DNS zone.
Incorrect Answers
B:Cross-tenant access policy can deny collaboration independently of an email-domain invitation list. Effective B2B acceptance involves both applicable controls.
C:Exchange mail acceptance does not prove that the domain is verified for Entra sign-in. The administrator must inspect the required verification evidence for this tenant, not rely on a working mailbox.
D:Products can contain individual service plans that are enabled or disabled independently. Product ownership by itself does not prove every contained service is active.
Question 103
An employee already signs in as a cloud member but HR wants a legal name shown in applications without changing their login name. Which attribute should be changed?
- Create a second cloud member with the same name instead of updating the employee's existing profile.
- Rewrite the department dynamic-group rule and assume it updates the employee's displayName property.
- Change the employee's Microsoft 365 usage location instead of correcting the existing identity's display name.
- Update the existing Entra user's displayName property.
Explanation
Correct Answer
D:Display name is a presentation attribute independent of the user principal name and object ID, so a profile update does not create a replacement identity.
Incorrect Answers
A:An additional member creates a different identity object and does not change the existing employee's visible name. Update displayName on the existing user.
B:Membership rules decide which objects belong to a group; they do not write the legal name visible in applications. Update the existing user's display-name field instead.
C:Product usageLocation affects eligibility and licensing in supported services; it is not the human-readable name displayed by applications. Change the existing user's displayName while retaining the sign-in identifier.
Question 104
A service unexpectedly loses a user reference after an administrator deletes and recreates the account with the same display name. What should the admin compare?
- Compare the old and new Entra user objectId values and restore the original identity if eligible.
- Create another member using the old displayName and assume all former object-ID references recover automatically.
- Look up the user's userPrincipalName rather than relying on displayName.
- Trigger dynamic-group reevaluation and assume a newly created user regains the deleted object's identifier.
Explanation
Correct Answer
A:Directory object IDs bind grants and application references. A recreated account has a different ID even if its visible name or email matches the deleted account.
Incorrect Answers
B:Display names are not immutable identity keys. A replacement account gets a different objectId, so dependent service links and restore eligibility require investigation.
C:UPN is an Entra user sign-in identifier and may differ from a human-readable display name. Display names can repeat or change.
D:Dynamic membership can include a replacement object, but it cannot restore the deleted user's immutable objectId. Compare the old and new IDs and eligible restore options.
Question 105
A branch-office employee has forgotten their password and the help desk wants a supported user-managed recovery process. What should be enabled?
- Determine the user's source of authority and update credentials through the synchronized identity system.
- Check the domain verification TXT record at its authoritative public DNS host.
- Scope self-service password reset to the appropriate Entra users and require authentication-method registration.
- Recognize the separation between Entra directory roles and Azure resource-management RBAC.
Explanation
Correct Answer
C:SSPR enables eligible users to prove identity and reset their password without ticket handling. It requires correct scope and sufficient registered methods.
Incorrect Answers
A:Synchronized objects may have attributes controlled by their on-premises origin. Cloud-only administrative actions do not automatically override that authority boundary.
B:Entra tests the published verification challenge for the domain; an email address or an internal DNS entry does not prove the tenant controls the required DNS zone. This matters here because a branch-office employee has forgotten their password and the help desk wants a supported user-managed recovery process.
D:The Contributor role authorizes Azure management actions at scope. Identity tasks require separately delegated directory privileges.
Question 106
Users see a message that they have not registered the required SSPR authentication details. What should be corrected?
- Block the user's sign-in in Entra and preserve the account for investigation.
- Prompt or require registration of the supported password-reset authentication methods.
- Refer primary password reset to the supplier's home identity administrator or self-service process.
- Grant the appropriate scoped Password Administrator capability for the relevant users.
Explanation
Correct Answer
B:A password reset fails if the account lacks enough registered recovery methods for the tenant's policy. A subscription role assignment cannot fulfill this identity verification.
Incorrect Answers
A:Blocking new sign-ins is a reversible identity action; it leaves the user object available for audit. Active tokens may require separate revocation.
C:The host resource tenant does not generally own an external corporate user's source credentials. Local guest management is not equivalent to home-tenant password authority.
D:Password Administrator provides supported reset operations for nonprivileged users and certain supported role targets. A general subscription Contributor role cannot manage tenant passwords.
Question 107
A company uses a department attribute to control who joins the research-access group without an administrator changing membership every month. Which group type should be chosen?
- Create a dynamic user security group with a supported department membership expression.
- Use a manually assigned group and rely on administrators to update membership when employees change departments.
- Separate licensing group membership from privileged Azure resource-management groups.
- Remove the contractor's membership from the access-granting Entra security group.
Explanation
Correct Answer
A:Entra evaluates supported user attributes and updates dynamic group membership when identities match the expression. A static group cannot track attribute changes automatically.
Incorrect Answers
B:Assigned membership cannot automatically track department attribute changes. The requested automatic behavior requires a supported dynamic user rule.
C:License eligibility should not automatically give members resource-admin rights. Separating purposes makes membership changes less dangerous.
D:Group-based application entitlements flow through membership. Removing one principal from the applicable group preserves the other members' access.
Question 108
The employee's department was updated but the dynamic group's membership has not changed after rule processing. What should be checked?
- Determine the user's source of authority and update credentials through the synchronized identity system.
- Check only the user's visible membership list without examining the dynamic rule processing result.
- Inspect the user's effective attributes and the dynamic membership rule's processing state.
- Inspect rule parentheses, logical operator precedence, and evaluated user attributes.
Explanation
Correct Answer
C:A changed department value does not prove that the dynamic group has re-evaluated the user successfully. Examine the effective department attribute, the actual membership expression, rule validation and processing state before forcing manual membership.
Incorrect Answers
A:Synchronized objects may have attributes controlled by their on-premises origin. Cloud-only administrative actions do not automatically override that authority boundary. This matters here because the employee's department was updated but the dynamic group's membership has not changed after rule processing.
B:Group membership reports can lag the attribute update, but the reported failure specifically follows dynamic rule processing. Validate the employee's department value, rule predicate and processing state, not merely an unrelated inherited membership list.
D:Boolean grouping affects dynamic rule outcomes. A rule that mixes AND and OR without the intended grouping may match broader users than the department requested.
Question 109
An audit team needs to remove a departing contractor's group-derived app access without deleting the group for other employees. What should be changed?
- Grant the guest the required enterprise application assignment or authorized group membership.
- Inspect application-assigned group memberships and applicable nested membership semantics.
- Remove the contractor's membership from the access-granting Entra security group.
- Create a dynamic user security group with a supported department membership expression.
Explanation
Correct Answer
C:Group-based application entitlements flow through membership. Removing one principal from the applicable group preserves the other members' access. This matters here because an audit team needs to remove a departing contractor's group-derived app access without deleting the group for other….
Incorrect Answers
A:Successful authentication does not automatically authorize access to an assigned enterprise application. The resource tenant still controls assignments and app policies.
B:Access can be conferred through groups rather than an explicit user assignment. Evaluate the application's supported transitive membership behavior rather than assuming all nested groups work identically.
D:Entra evaluates supported user attributes and updates dynamic group membership when identities match the expression. A static group cannot track attribute changes automatically. This matters here because an audit team needs to remove a departing contractor's group-derived app access without deleting the group for other….
Question 110
An auditor must view configuration of one application resource group but cannot modify anything. Which Azure role assignment is appropriate?
- Assign Reader at the appropriate management-group scope.
- Remove unnecessary delete Actions from the custom role definition and reassess effective assignments.
- Assign Reader at the specific resource-group scope.
- Assign Contributor to the engineer at the team resource-group scope.
Explanation
Correct Answer
C:Reader grants management-plane visibility without write permissions. Scoping at the resource group avoids exposing unrelated subscriptions.
Incorrect Answers
A:Roles granted on a management-group ancestor can be inherited by descendant subscriptions and resources. This is broader than a single resource-group grant.
B:Least privilege requires granting only the provider operations the workload needs. Removing delete from one role still requires checking other positive grants.
D:Contributor manages supported Azure resources but does not include role-assignment administration. The assignment should be limited to the group's operational boundary.
