Microsoft AZ-104 Practice Test 2
Question 10
A developer can create a VM as a Contributor in a resource group but receives an authorization error when assigning another employee Reader access. What explains the failure?
- Contributor cannot manage Azure role assignments by default
- The Reader role cannot be assigned to users
- VMs do not support resource-group-level role assignments
- The employee must have a storage account access key
Explanation
Correct Answer
A:Contributor manages many resources but ordinarily lacks Microsoft.Authorization/roleAssignments/write. A principal with role-assignment authority such as Owner or a suitable RBAC access administrator must perform the grant.
Incorrect Answers
B:Reader is a valid built-in Azure RBAC role assignable to appropriate principals. The problem is the developer's authority to grant it, not that the role is invalid.
C:Azure RBAC supports assignments at management group, subscription, resource group and eligible resource scopes. The requested group scope is meaningful and inheritable.
D:Storage keys authorize supported storage data operations and are irrelevant to granting an Azure management-plane Reader role. A key cannot replace role assignment permissions.
Question 11
A platform admin must manage Azure RBAC access assignments at a subscription but should not receive permission to edit all resources. Which built-in role is purpose-made for access assignment?
- Reader
- Monitoring Reader
- User Access Administrator
- Storage Blob Data Reader
Explanation
Correct Answer
C:User Access Administrator is intended for managing access to Azure resources, including RBAC role assignments at its scope. Assign it only where access delegation is required, not automatically at tenant or management-group scope.
Incorrect Answers
A:Reader permits inspecting resources but lacks rights to create or remove Azure role assignments. It cannot administer access delegation.
B:Monitoring Reader can inspect monitoring data without being a general role-assignment administrator. Observability privileges do not provide Microsoft.Authorization/roleAssignments/write.
D:Storage Blob Data Reader is a data-plane role for viewing blob contents. It does not control who receives management-plane role assignments at the subscription.
Question 12
An Azure RBAC Reader role is assigned at a management group containing two subscriptions. Where is the permission normally inherited?
- Only on the management group object, not its child subscriptions
- Across descendant subscriptions and eligible resources, subject to applicable access constraints
- Only inside Microsoft Entra enterprise applications
- Only on the administrator's currently selected Azure portal page
Explanation
Correct Answer
B:Management-group assignments can flow through child subscriptions, resource groups and resources. Effective access must also account for any deny assignments or other restrictions and should be verified at the intended resource.
Incorrect Answers
A:Azure RBAC role assignments at a parent scope normally inherit to descendants. The role would not be limited to viewing just the management-group metadata.
C:Enterprise application access uses separate identity and application authorization paths. A management-group Reader role governs Azure resources rather than automatically granting app sign-in.
D:Portal navigation affects what is displayed but not the underlying authorization scope. Effective access is determined by role assignments and scope inheritance.
Question 13
A help desk analyst has Microsoft Entra User Administrator but cannot restart an Azure VM. What is the missing authorization plane?
- A Microsoft Entra tenant-wide administrative password
- An Azure RBAC role permitting VM management at the appropriate resource scope
- A storage blob's access tier
- An Azure Policy audit effect
Explanation
Correct Answer
B:Azure resource actions such as restarting VMs require Azure RBAC permissions at a resource, group or parent scope. Entra User Administrator alone does not grant virtual-machine management rights.
Incorrect Answers
A:Directory roles control Entra identity operations; possessing or asking for a tenant-wide password is neither appropriate nor an Azure VM authorization mechanism.
C:Blob tiering is a data lifecycle and cost characteristic. It cannot grant permissions to perform VM compute operations.
D:A Policy audit effect records noncompliance and does not grant users VM management privileges. Governance evaluation and RBAC authorization are distinct.
Question 14
An operator can view a storage account but receives 403 when reading a private blob with Microsoft Entra authentication. What is the likely permission gap?
- The Reader control-plane role alone does not confer blob data read permission
- The storage account name must be changed
- Storage accounts cannot use Entra authorization
- Azure Advisor recommendations have not been dismissed
Explanation
Correct Answer
A:Control-plane Reader authorizes management inspection, not necessarily data-plane reads of private blobs. Assign a suitable data role such as Storage Blob Data Reader at the narrowest necessary scope and check network restrictions.
Incorrect Answers
B:Changing an account's resource name is unrelated to an authenticated blob data operation. Names identify resources rather than granting data-plane privileges.
C:Azure Blob Storage supports Microsoft Entra authorization and fine-grained data roles. The 403 calls for examining effective data roles and network policy, not assuming the authentication method is unsupported.
D:Advisor findings are recommendations and do not automatically become data access grants. Dismissing them cannot satisfy blob read authorization.
Question 15
A team requests an audit of why a user can delete a resource even though no role is assigned directly at that resource. Where should the administrator inspect?
- Only the resource's tags
- Inherited role assignments at parent resource group, subscription and management-group scopes
- The VM's operating system patch history
- The storage account's immutable blob policy
Explanation
Correct Answer
B:Azure RBAC permits inherited role assignments from ancestor scopes. Inspect effective access and parent assignments, plus applicable deny assignments, to identify why the principal has the resource-delete action.
Incorrect Answers
A:Tags classify resources and can drive governance, but they are not access-control grants. A tag cannot explain effective delete permission by itself.
C:OS patch history affects workload maintenance and security, not Azure management-plane role inheritance. It does not explain the user's resource deletion capability.
D:A blob immutability policy protects eligible blob data and is not a general explanation of Azure resource deletion authorization.
Question 16
A critical resource group must not be deleted, but operators should continue changing resources inside it. Which resource-management protection is most suitable?
- A CanNotDelete lock at the resource-group scope
- A ReadOnly lock at the subscription scope
- A billing budget notification
- A tag named protect=true without policy
Explanation
Correct Answer
A:A CanNotDelete management lock prevents deletion of the protected group and inherited child resources while still allowing ordinary modifications that do not require deleting those resources. Check workflow-specific operations that may need deletion or recreation.
Incorrect Answers
B:ReadOnly is more restrictive and would block many control-plane updates throughout the subscription. This exceeds the requirement to prevent deletion only.
C:Budgets notify about spending thresholds but do not enforce deletion prevention or protect resource topology. Cost alerts are not resource locks.
D:Tags alone are metadata. A protect tag has no automatic delete-prevention effect unless a separate enforceable rule is implemented.
Question 17
An application team must prevent even valid Azure management updates to a production resource while allowing retrieval of its configuration. Which lock type fits?
- CanNotDelete
- ReadOnly
- An Azure Budget
- A group-based Microsoft 365 license
Explanation
Correct Answer
B:ReadOnly blocks management-plane write operations on the scope while allowing read operations. Evaluate effects on service operations that invoke control-plane writes; it is not an automatic data-plane read-only policy.
Incorrect Answers
A:CanNotDelete blocks deletion but normally still permits modification. It is too weak for a requirement that prohibits configuration updates.
C:A budget evaluates planned expenditure and alerts on thresholds. It does not restrict administrative writes to the protected resource.
D:Product licenses control user entitlement to Microsoft services rather than Azure resource write capability. They cannot replace an Azure resource lock.
Question 18
A subscription policy denies creating public IP resources. A developer with Owner at a resource group attempts to create one and is blocked. What should the developer conclude?
- The Owner role overrides any Azure Policy assignment
- Azure Policy can deny a noncompliant deployment independently of RBAC permissions
- A tag exemption is automatically created for resource-group Owners
- The user must enable self-service password reset
Explanation
Correct Answer
B:The deny effect rejects a deployment that fails the assigned policy rule even if the caller otherwise has sufficient RBAC rights. An authorized policy exemption or policy change requires its own governance process.
Incorrect Answers
A:Owner supplies broad management permissions but does not automatically bypass enforceable governance conditions. RBAC authorization and Azure Policy compliance are separate checks.
C:Tags do not automatically create policy exemptions for resource-group owners. A scoped exemption must be deliberately defined and authorized where appropriate.
D:SSPR is an identity recovery feature. It cannot change resource deployment policy evaluation for a new public IP address.
Question 19
An organization wants to identify storage accounts violating its network standard without blocking existing or future deployments during observation. Which policy effect is best?
- Deny
- Audit
- Disabled
- Append a shared access signature
Explanation
Correct Answer
B:Audit evaluates and records resources as noncompliant while permitting deployment to proceed. It supports a staged governance rollout so administrators can understand current impact before selecting stronger effects.
Incorrect Answers
A:Deny rejects matching noncompliant create/update operations, which is contrary to an observation-only rollout. It is appropriate only when the organization is ready to enforce.
C:Disabled turns off policy evaluation entirely and would not provide the required compliance visibility. No audit results would be produced by that assignment.
D:Shared access signatures delegate storage data access, not resource policy compliance. Appending one does not audit network settings or enforce standards.
Question 20
A governance lead must assign a common collection of location, tag and encryption policies to several subscriptions as one reusable package. What is the Azure Policy feature?
- A management lock
- A policy initiative definition
- An Azure Files snapshot
- An application security group
Explanation
Correct Answer
B:An initiative groups multiple Azure Policy definitions into a reusable policy set that can be assigned and assessed together. Use an appropriate scope and parameter values for each subscription.
Incorrect Answers
A:Locks prevent deletion or management changes but do not package heterogeneous policy rules for compliance assignment. They are a separate resource-protection feature.
C:File-share snapshots provide point-in-time data recovery. They have no role in grouping governance policies across subscriptions.
D:Application security groups help organize VM NICs in network security rules. They do not provide subscriptions with shared governance requirements.
