Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

Locks prevent deletion or management changes but do not package heterogeneous policy rules for compliance assignment. They are a separate resource-protection feature.

File-share snapshots provide point-in-time data recovery. They have no role in grouping governance policies across subscriptions.

Application security groups help organize VM NICs in network security rules. They do not provide subscriptions with shared governance requirements.

A resource lock constrains resource deletion, not billing accumulation. It cannot express an alert when cost approaches a financial target.

An NSG controls network traffic. Blocking HTTPS can disrupt services without ensuring spending stays under a budget or notifying finance.

A SAS expiry limits delegated access to storage resources. It does not enforce subscription cost controls or notify anyone about spending.

Resource-group tags are separate metadata and are not automatically propagated to child resources. Assuming automatic inheritance can make cost allocation reports inaccurate.

Azure virtual machines support resource tags. The missing tag reflects lack of explicit propagation, not a VM tagging limitation.

Directory domain join governs host sign-in and identity integration. It has no automatic relationship to Azure resource tag inheritance.

Mass deletion is unnecessarily destructive and may lose production state. Compliance remediation should update eligible properties where possible, not assume recreation is mandatory.

Global Administrator is an Entra tenant role and does not automatically solve policy remediation authorization. Grant only the required Azure resource rights to the assignment identity.

Geo-redundancy is a storage resiliency setting. Changing it does not address missing governance tags across arbitrary existing resources.

A NIC is a single resource and is far too narrow for a division-wide deployment standard. It would also not cover new services elsewhere.

An Entra group defines identities but is not itself the ARM policy hierarchy covering subscriptions. Governance must be applied at an appropriate Azure scope.

An email domain is an identity namespace, not a scope for restricting Azure resource locations across subscriptions.

The account key grants broad signing and storage access authority. Publishing it to browser code risks compromise across unrelated containers and cannot meet least privilege.

Azure RBAC Owner permits extensive resource management and is not an appropriate permission for anonymous or short-lived browser uploads. It would expose administrative control.

Resource locks constrain management-plane deletion or changes, not browser data-plane authorization. A lock cannot grant a visitor temporary blob-upload permission.

An account SAS is signed with a storage account key and can have broad service-level scope. It does not satisfy the no-account-key preference.

Service SAS also uses Shared Key and therefore requires access to a storage key at issuance. A scoped service SAS can be useful, but the requirement favors identity-backed delegation.

A stored access policy defines constraints for certain service SAS tokens; by itself it is not the signed token a blob client presents. It is not an Entra-backed delegation signature.

Subscription names are administrative labels and do not alter SAS signatures or the referenced container policy. The old token can remain valid.

Availability zones affect compute placement, not storage SAS authorization. VM moves cannot invalidate delegated container access.

Diagnostic settings route logs and metrics; deleting them weakens visibility but does not revoke SAS token permissions or expiration.

Display names are user metadata and do not decide network access. The principal may be correctly authenticated yet blocked before the data request is accepted.

Resource group tags organize resources but do not open a restricted storage firewall. Tag count is unrelated to a network-level 403.

Password self-service enables identity recovery, not access through a storage account's network perimeter. It cannot repair an unapproved source network.

Public blob access concerns HTTP blob containers, not identity-backed SMB file shares. Making data anonymous violates the enterprise file access requirement.

SAS tokens are designed for specific REST access patterns and do not replace the configured SMB identity and file-share authorization flow used by domain-integrated clients.

Azure Policy exemptions change governance evaluation and are not an authentication provider or permission structure for file-share access.

SSPR manages user password recovery and does not determine which authorization mechanism Blob Storage accepts. Disabling it would add risk without meeting the goal.

Annual key rotation reduces stale secret exposure but continues to permit requests signed with shared keys. It does not prohibit that authentication method.

Redundancy controls replication and durability. Geographic copies do not determine whether Shared Key requests are authorized.