Microsoft AZ-104 Practice Test 22
Question 210
A web service authenticates with its managed identity and must read one blob container rather than list storage accounts. Which permission plane is needed?
- Assign Storage Blob Data Reader at the target container scope.
- Grant subscription-wide Reader and expect it to provide container-scoped Blob data-plane read access.
- Review the applicable Azure Files data-plane or share-level authorization model.
- Confirm Key Vault's RBAC permission model and the user's secret data-plane role.
Explanation
Correct Answer
A:Blob contents require storage data-plane DataActions. Management-plane Reader of the storage account does not itself grant ordinary blob contents access.
Incorrect Answers
B:Azure resource Reader is a management-plane role and does not confer reading private blob content. Assign a storage Blob data role at the container scope for the managed identity.
C:Azure Files content permissions require suitable share authorization and possibly file ACLs depending on the identity model. Control-plane Reader is insufficient.
D:The resource-management plane and vault secret data operations are distinct. A vault may require Key Vault Secrets User or another specifically authorized data-plane role.
Question 211
A service principal can view the storage account in the portal but receives BlobAuthorizationPermissionMismatch reading a blob. What should be checked?
- Inspect effective Storage Blob Data role assignments and inherited data permissions.
- Check the role assignment scope; resource-level Owner does not inherit to siblings or ancestors.
- Assign Azure management Reader and assume it grants the service principal permission to download private blobs.
- Use the storage account's Access control (IAM) Check access and role assignments views.
Explanation
Correct Answer
A:Viewing an ARM storage resource and reading blob data use different permissions. A missing data-plane role can cause this authorization failure.
Incorrect Answers
B:Azure RBAC inheritance flows down the hierarchy. Permission granted to one resource does not expand to its parent group or unrelated resources. This matters here because a service principal can view the storage account in the portal but receives BlobAuthorizationPermissionMismatch….
C:Control-plane inspection and Blob data reads require different Actions/DataActions. Check the relevant Blob data role and network path.
D:Azure IAM views list direct assignments and can help evaluate the selected principal's effective access. This is not a blob data transaction log. This matters here because a service principal can view the storage account in the portal but receives BlobAuthorizationPermissionMismatch….
Question 212
A key-management application needs to retrieve secret values while the vault uses Azure RBAC authorization. Which role is most narrowly relevant?
- Review generic resource delete permissions but omit the Key Vault secret-value data-plane grant.
- Assign Virtual Machine Contributor rather than the Key Vault secret-read permissions required by the app.
- Assign Owner at the smallest authorized Azure scope.
- Assign an appropriate Key Vault Secrets User role at the intended vault or secret scope.
Explanation
Correct Answer
D:An Azure resource Reader can see vault properties but not secret values. Key Vault data-plane roles authorize secret operations.
Incorrect Answers
A:The application needs an eligible Key Vault Secrets User or equivalent secrets data role, not unrelated delete Actions.
B:VM management permissions do not authorize reading Key Vault secret values. Review the vault's RBAC model and use an appropriately scoped data-plane secrets role.
C:Owner includes ordinary resource management and role-assignment control. Its broad reach warrants tight scope and governance. This matters here because a key-management application needs to retrieve secret values while the vault uses Azure RBAC authorization. Which….
Question 213
A developer with subscription Reader can list a Key Vault resource but fails to retrieve secrets. Why?
- Review the applicable Azure Files data-plane or share-level authorization model.
- Use an applicable Azure deny assignment where created by supported Azure services.
- Assign Storage Blob Data Reader at the target container scope.
- Confirm Key Vault's RBAC permission model and the user's secret data-plane role.
Explanation
Correct Answer
D:The resource-management plane and vault secret data operations are distinct. A vault may require Key Vault Secrets User or another particularally authorized data-plane role.
Incorrect Answers
A:Azure Files content permissions require suitable share authorization and possibly file ACLs depending on the identity model. Control-plane Reader is insufficient. This matters here because a developer with subscription Reader can list a Key Vault resource but fails to retrieve secrets. Why.
B:Deny assignments restrict actions even if a role permits them. They are not ordinary user-created substitute roles and have distinct management rules.
C:Blob contents require storage data-plane DataActions. Management-plane Reader of the storage account does not on its own grant ordinary blob contents access.
Question 214
A temporary incident responder needs to manage a production storage resource for a limited response window. How should the grant be applied?
- Permanently assign RBAC Administrator at subscription scope for one time-limited storage-response activity.
- Use an approved time-bounded Azure RBAC assignment at the smallest scope.
- Filter Activity Log by authorization provider operation, target scope, and event time.
- Delegate separate RBAC assignment administration only if approved, using a suitable scoped access role.
Explanation
Correct Answer
B:Temporary privileged access reduces long-lived exposure. Record an owner and revoke or expire the assignment when the response is complete.
Incorrect Answers
A:Permanent subscription-wide access delegation is broader and longer-lived than the incident task. Use an appropriately scoped, time-limited grant for actual storage management operations.
C:Historical control-plane records identify operations and actors. Inspecting only the current IAM list will not show past change events.
D:Resource modification rights do not imply authority to grant permissions. Role Based Access Control Administrator or User Access Administrator covers assignment tasks under appropriate conditions. This matters here because a temporary incident responder needs to manage a production storage resource for a limited response window.
Question 215
A privileged incident task finished yesterday but the assignment is still active. What corrective review is required?
- Inspect file and directory ACLs in addition to the share-level role.
- Remove one unrelated resource-level grant and assume all temporary privileged role assignments have expired.
- Inspect temporary role expiry or remove the obsolete elevation and review audit history.
- Use a least-privileged governance inspection role scoped to the evaluated resources.
Explanation
Correct Answer
C:Time-bounded access should be actively withdrawn when no longer needed. A closed ticket by itself does not revoke Azure RBAC permissions.
Incorrect Answers
A:Azure Files SMB access may involve both share-level RBAC and filesystem ACLs. One successful authorization step does not eliminate the other.
B:Privilege cleanup must examine the actual assignment and its lifetime, including active/eligible roles and inherited scopes. An unrelated child grant says nothing about the stale incident elevation.
D:Policy compliance review needs read permissions, not blanket Owner or Contributor. Role choice and scope should reflect the reporting requirement.
Question 216
A regulated subscription must reject creation of resources in unapproved Azure regions at request time. Which effect enforces this?
- Attach the CanNotDelete lock at the database resource scope.
- Inspect the policy effect for audit or auditIfNotExists instead of deny.
- Use an Azure Policy deny effect with allowed locations configured.
- Assign an Azure Policy deny rule that evaluates the costCenter tag against approved values.
Explanation
Correct Answer
C:A deny policy can block noncompliant Resource Manager requests before creation. Dashboard alerts do not enforce deployment constraints.
Incorrect Answers
A:A resource-specific lock protects only the selected asset rather than every descendant in the resource group. Parent locks could have a wider blast radius.
B:Audit-style effects report violating resources while allowing creation. Compliance status is not always a record of a failed deployment. This matters here because a regulated subscription must reject creation of resources in unapproved Azure regions at request time. Which effect….
D:Deny can prevent unauthorized tag values in management requests. A free-form operational convention cannot enforce an allowlist.
Question 217
An operator changes a tag but an unrelated deny policy rejects deployment outside permitted regions. What should be checked?
- Inspect the applicable Azure Policy tag-value allowlist and deny evaluation result.
- Inspect the policy effect for audit or auditIfNotExists instead of deny.
- Inspect the initiative definition and individual policy reference IDs.
- Inspect policy evaluation details and the allowedLocations parameter in the effective assignment.
Explanation
Correct Answer
D:A deny decision depends on evaluated resource properties and assignment parameters. Changing unrelated tags will not fix a location outside the allowlist.
Incorrect Answers
A:The failed tag value violates an enforced resource governance condition. The creator's Azure Contributor permission cannot override it. This matters here because an operator changes a tag but an unrelated deny policy rejects deployment outside permitted regions.
B:Audit-style effects report violating resources while allowing creation. Compliance status is not always a record of a failed deployment. This matters here because an operator changes a tag but an unrelated deny policy rejects deployment outside permitted regions.
C:An initiative aggregates multiple definitions under one assignment. Individual policy references retain distinct evaluation results.
Question 218
A platform team needs to package a dozen related resource policies into one assignable governance unit. Which object should be created?
- Build a management-group hierarchy aligned to governance boundaries.
- Create a separate location-deny policy assignment and assume it packages all twelve independent policy definitions into a reusable set.
- Create a resource group for resources with a shared lifecycle.
- Create an Azure Policy initiative containing the required policy definitions.
Explanation
Correct Answer
D:Initiatives group definitions for assignment and aggregate compliance reporting. Resource locks do not combine definitions into policy packages. This matters here because a platform team needs to package a dozen related resource policies into one assignable governance unit. Which object….
Incorrect Answers
A:Management groups support broad governance scope and administrative inheritance. Naming individual subscription resources is not an effective hierarchy.
B:A single policy assignment evaluates only its referenced definition. An initiative is the reusable policy-set object that bundles several individual policy definitions for assignment and compliance tracking.
C:Resource groups collect related assets for administration and deletion as a unit. They are not an availability or replication boundary. This matters here because a platform team needs to package a dozen related resource policies into one assignable governance unit. Which object….
Question 219
A compliance dashboard displays one initiative with many policy definition results. What object is providing the grouping?
- Check subscription-level compute vCPU quotas for the applicable region and VM family.
- Open a single resource policy exemption and assume it is the reusable grouping for all initiative definitions.
- Inspect the initiative definition and individual policy reference IDs.
- Create an Azure Cost Management budget with threshold notifications.
Explanation
Correct Answer
C:An initiative aggregates multiple definitions under one assignment. Individual policy references retain distinct evaluation results. This matters here because a compliance dashboard displays one initiative with many policy definition results. What object is providing the….
Incorrect Answers
A:Quota is evaluated per subscription and relevant region/family. A storage account capacity metric cannot establish available VM family quota. This matters here because a compliance dashboard displays one initiative with many policy definition results. What object is providing the….
B:An initiative groups multiple policy definitions and reference IDs. An exemption only excuses an eligible scope from an assignment or selected definitions.
D:Budgets track accumulated or forecast cost and notify at configured percentages. They do not universally stop running resources when exceeded.
Question 220
The security organization allows a temporary deviation from one Azure Policy for a single workload. How can it avoid weakening all subscriptions?
- Disable the restrictive policy assignment at the entire management-group root for the duration of this single resource exception.
- Use Azure Policy compliance state and assignment evaluation details for the reporting scope.
- Assign the location-deny Azure Policy at a suitable management-group ancestor.
- Create a narrowly scoped, justified Azure Policy exemption with expiration.
Explanation
Correct Answer
D:An exemption can document approved exceptions without globally removing the governing policy assignment. Scope and expiry control exposure. This matters here because the security organization allows a temporary deviation from one Azure Policy for a single workload. How can it avoid….
Incorrect Answers
A:Removing the parent assignment would weaken every inherited subscription rather than just the exceptional workload. An approved time-limited resource-scoped policy exemption is the narrowly targeted alternative.
B:Compliance records identify evaluated resources and policies with noncompliant states. A tag listing alone does not indicate whether a complex initiative passes. This matters here because the security organization allows a temporary deviation from one Azure Policy for a single workload. How can it avoid….
C:Management-group assignments apply to descendant subscriptions. A subscription-local policy would need repeated assignments for every child subscription. This matters here because the security organization allows a temporary deviation from one Azure Policy for a single workload. How can it avoid….
