Microsoft AZ-104 Practice Test 32
Question 310
An Azure user has two role grants: Reader directly and Contributor through a security group. How are the effective ordinary grants evaluated?
- Use Check access for the actual user or service principal and review inherited paths.
- Combine applicable direct, group-derived, and inherited Azure RBAC grants.
- Compare the two groups' inherited and direct effective role assignments.
- Check whether the operator holds policy remediation and resource-write permissions rather than only reader actions.
Explanation
Correct Answer
B:Azure RBAC generally adds the allowed actions from applicable assignments, subject to deny assignments and other controls. Reviewing only the direct role undercounts access.
Incorrect Answers
A:IAM effective access considers assignments through security groups and ancestor scopes, not only assignments displayed for a single principal.
C:An assignment on one resource group does not automatically cover a sibling group. The shared subscription alone does not imply shared privileges.
D:Reading compliance and modifying resources are separate operations. A read-only role does not imply authority to run write-based remediations. This matters here because an Azure user has two role grants: Reader directly and Contributor through a security group. How are the effective….
Question 311
A user still edits a resource after their direct Contributor grant is removed. What should the auditor inspect?
- Remove only the explicit resource assignment and ignore Contributor permissions inherited through a parent scope or group.
- Review the applicable Azure Files data-plane or share-level authorization model.
- Review inherited and group-based Contributor assignments at ancestor scopes.
- Check only the removed direct Contributor assignment and ignore group membership and inherited grants.
Explanation
Correct Answer
C:Removing one role assignment does not remove independent group or ancestor permissions. Effective access must be evaluated across all applicable grants.
Incorrect Answers
A:Effective resource RBAC is the union of applicable assignments, including parent scopes and group memberships. Inspect inherited grants and deny assignments to explain continued write access.
B:Azure Files content permissions require suitable share authorization and possibly file ACLs depending on the identity model. Control-plane Reader is insufficient. This matters here because a user still edits a resource after their direct Contributor grant is removed.
D:Effective authorization is additive across eligible scopes and principals. An ancestor or group assignment may still allow edits.
Question 312
A custom role includes Microsoft.Compute/virtualMachines/read but must not allow writes. Which role-definition section controls this?
- Add Microsoft.Compute/virtualMachines/write to the custom role Actions while claiming the role is read-only.
- Put the appropriate read-only ARM operation in Actions and omit write Actions.
- Remove unnecessary delete Actions from the custom role definition and reassess effective assignments.
- Check whether the operator holds policy remediation and resource-write permissions rather than only reader actions.
Explanation
Correct Answer
B:Custom roles explicitly enumerate management-plane permissions. Actions determine permitted resource operations, while DataActions describe supported service data operations. This matters here because a custom role includes Microsoft.Compute/virtualMachines/read but must not allow writes. Which role-definition….
Incorrect Answers
A:Including the write action authorizes virtual-machine changes, conflicting with the read-only requirement. Specify permitted read actions and exclude management writes from the effective role definition.
C:Least privilege requires granting only the provider operations the workload needs. Removing delete from one role still requires checking other positive grants. This matters here because a custom role includes Microsoft.Compute/virtualMachines/read but must not allow writes. Which role-definition….
D:Reading compliance and modifying resources are separate operations. A read-only role does not imply authority to run write-based remediations. This matters here because a custom role includes Microsoft.Compute/virtualMachines/read but must not allow writes. Which role-definition….
Question 313
A custom role includes a NotActions delete exclusion but a separate role grants deletion. Why may deletion still succeed?
- Compare the assignment principal ID against directory deleted objects and surviving service principals.
- Recognize that NotActions only excludes permissions from its own role and is not a global deny.
- Use Check access for the actual user or service principal and review inherited paths.
- Remove unnecessary delete Actions from the custom role definition and reassess effective assignments.
Explanation
Correct Answer
B:Effective positive role assignments are combined. To impose a hard prohibition, examine deny assignments or policy/locks rather than relying on NotActions across roles.
Incorrect Answers
A:RBAC references can outlive removal of the directory object. Reusing the deleted user's friendly name is not reliable evidence of its identity.
C:IAM effective access considers assignments through security groups and ancestor scopes, not only assignments displayed for a single principal. This matters here because a custom role includes a NotActions delete exclusion but a separate role grants deletion. Why may deletion still succeed.
D:Least privilege requires granting only the provider operations the workload needs. Removing delete from one role still requires checking other positive grants. This matters here because a custom role includes a NotActions delete exclusion but a separate role grants deletion. Why may deletion still succeed.
Question 314
An organization must prevent deletes on a managed resource even for principals with broad positive RBAC roles. Which security construct can block granted actions?
- Use an applicable Azure deny assignment where created by supported Azure services.
- Combine applicable direct, group-derived, and inherited Azure RBAC grants.
- Give the operator Role Based Access Control Administrator to prevent deletion of the protected resource.
- Apply the role at an ancestor scope so its allowed actions flow to descendants.
Explanation
Correct Answer
A:Deny assignments restrict actions even if a role permits them. They are not ordinary user-created substitute roles and have distinct management rules. This matters here because an organization must prevent deletes on a managed resource even for principals with broad positive RBAC roles. Which….
Incorrect Answers
B:Azure RBAC generally adds the allowed actions from applicable assignments, subject to deny assignments and other controls. Reviewing only the direct role undercounts access. This matters here because an organization must prevent deletes on a managed resource even for principals with broad positive RBAC roles. Which….
C:Managing role assignments does not itself deny deletion to already authorized principals. A properly scoped management lock or enforceable deny mechanism is the requested protection.
D:A role assignment at a resource group covers existing and newly created child resources where the role applies. Inheritance does not require per-resource duplication. This matters here because an organization must prevent deletes on a managed resource even for principals with broad positive RBAC roles. Which….
Question 315
An Owner cannot delete a resource inside a service-managed deployment. What should be inspected?
- Review inherited and group-based Contributor assignments at ancestor scopes.
- Assign another Owner role at subscription scope and assume it bypasses the deployment's deny assignment.
- Inspect inherited or resource-scoped deny assignments and their excluded principals or actions.
- Use an approved time-bounded Azure RBAC assignment at the smallest scope.
Explanation
Correct Answer
C:An effective deny assignment can supersede an ordinary Owner grant. Additional positive assignments generally cannot override the denial.
Incorrect Answers
A:Removing one role assignment does not remove independent group or ancestor permissions. Effective access must be evaluated across all applicable grants. This matters here because an Owner cannot delete a resource inside a service-managed deployment.
B:Deny assignments can block actions even with Owner access. Inspect the system-managed deny configuration and permitted exceptions.
D:Temporary privileged access reduces long-lived exposure. Record an owner and revoke or expire the assignment in cases where the response is complete.
Question 316
A custom role should be assignable only inside a specified subscription. Which definition property limits assignment locations?
- Apply the role at an ancestor scope so its allowed actions flow to descendants.
- Put the subscription ID in a role's description instead of configuring its assignableScopes property.
- Write the subscription ID in the custom role description while leaving assignableScopes unrestricted.
- Set the custom role's assignableScopes to the allowed subscription or ancestor scope.
Explanation
Correct Answer
D:Assignable scopes constrain where a custom role definition can be assigned. They are distinct from the actual scope of each individual assignment.
Incorrect Answers
A:A role assignment at a resource group covers existing and newly created child resources where the role applies. Inheritance does not require per-resource duplication. This matters here because a custom role should be assignable only inside a specified subscription. Which definition property limits assignment….
B:Descriptive text is not an access-control scope. Set the custom role's assignableScopes to valid subscription or ancestor locations where role assignment is permitted.
C:Human-readable role metadata does not constrain where the role can be assigned. Configure the assignableScopes field appropriately.
Question 317
A subscription Owner cannot change a property on an otherwise healthy locked VNet. What should the administrator inspect?
- Inspect inherited CanNotDelete locks on the VM or parent scopes.
- Review ReadOnly locks inherited from resource group or subscription scopes.
- Apply a modify policy effect with the necessary managed identity permissions for tag changes.
- Inspect and correct its management-group parent relationship after assessing inherited policies.
Explanation
Correct Answer
B:An Azure lock can block management operations even in cases where the user holds Owner. The authorized lock owner must remove or adjust it before the write.
Incorrect Answers
A:Management locks are enforced independently of positive RBAC permissions. A delete lock may block Owner and Contributor deletion attempts. This matters here because a subscription Owner cannot change a property on an otherwise healthy locked VNet.
C:Modify can add or change supported resource tags as requests are processed; it is different from an audit-only compliance report. This matters here because a subscription Owner cannot change a property on an otherwise healthy locked VNet.
D:A subscription's parent management group controls inherited assignments. Moving it changes policy and RBAC conditions and needs impact review. This matters here because a subscription Owner cannot change a property on an otherwise healthy locked VNet.
Question 318
An administrator needs to apply a common owner tag to one resource group and all its future resources. What behavior must be understood?
- Run a one-time remediation task and assume all future deployments inherit group tags automatically without policy.
- Use Azure Policy tag inheritance or modification because resource tags do not automatically inherit.
- Add an owner tag to the resource group and assume Azure automatically copies it to all new children.
- Assign an Azure Policy deny rule that evaluates the costCenter tag against approved values.
Explanation
Correct Answer
B:Resource group tags do not automatically copy to child resources. An appropriate policy is required to apply or enforce matching metadata. This matters here because an administrator needs to apply a common owner tag to one resource group and all its future resources. What behavior….
Incorrect Answers
A:A one-time remediation can correct existing resources but does not make resource-group tags automatically appear on every future resource. Use Azure Policy for inheritance/modification.
C:Resource-group tags are not automatically inherited by deployed resources. Configure a scoped policy with an appropriate modify/append effect if the organization needs automatic tag propagation and remediation.
D:Deny can prevent unauthorized tag values in management requests. A free-form operational convention cannot enforce an allowlist. This matters here because an administrator needs to apply a common owner tag to one resource group and all its future resources. What behavior….
Question 319
A cost report groups by resource tag, but a VM has none despite its group being tagged. Why is it missing?
- Review role assignments inherited from the management-group tree after reparenting.
- Inspect the VM tags directly and the existence of a tag-inheritance policy.
- Check billing tag inclusion, cost attribution support and resource tag propagation.
- Inspect Advisor recommendations and the workload utilization evidence supporting them.
Explanation
Correct Answer
B:Tagging the parent group is not equivalent to tagging each child. Cost reporting by resource tag needs metadata on the actual billable resource.
Incorrect Answers
A:Changing the management-group ancestry changes ancestor role inheritance. The permission may originate above the subscription. This matters here because a cost report groups by resource tag, but a VM has none despite its group being tagged. Why is it missing.
C:Not every charge maps cleanly to all resource tags. The report must use a supported dimension and relevant cost data.
D:Historical costs quantify spend, while Advisor may suggest technical changes to underutilized resources. Recommendations still require workload validation.
Question 320
A subscription contains workloads in several business units; finance must see costs by team. Which metadata strategy aids chargeback?
- Build a management-group hierarchy aligned to governance boundaries.
- Open Azure Service Health and configure relevant service-health alerts.
- Apply consistent resource tags for businessUnit and environment to relevant resources.
- Place the test workload in an appropriately governed Azure subscription.
Explanation
Correct Answer
C:Tags provide dimensions for grouping costs where billing meters support them. A display name alone is an unreliable allocation category. This matters here because a subscription contains workloads in several business units; finance must see costs by team. Which metadata strategy….
Incorrect Answers
A:Management groups support broad governance scope and administrative inheritance. Naming individual subscription resources is not an effective hierarchy. This matters here because a subscription contains workloads in several business units; finance must see costs by team. Which metadata strategy….
B:Service Health reports subscription-affecting incidents and planned maintenance. The Resource Health blade targets individual asset condition.
D:Subscriptions provide distinct billing, quota and administrative boundaries. Resource groups alone do not produce separate subscription-level billing scopes. This matters here because a subscription contains workloads in several business units; finance must see costs by team. Which metadata strategy….
