Microsoft AZ-104 Practice Test 41
Question 400
A team has correct data replicas but a manual failover takes six hours, exceeding its target. What should it improve?
- Use least-privileged Azure Backup RBAC roles and secure the vault against destructive operations.
- Increase replication frequency without rehearsing the six-hour manual application restart sequence.
- Initiate a planned or unplanned Site Recovery failover as appropriate to the incident.
- Automate and rehearse the recovery runbook to reduce actual RTO.
Explanation
Correct Answer
D:Replication alone does not ensure timely application availability. Recovery orchestration and validation consume time. This matters here because a team has correct data replicas but a manual failover takes six hours, exceeding its target.
Incorrect Answers
A:Backup management roles should reflect tasks such as read-only monitoring or restore. Owner grants can expose unnecessary protection control. This matters here because a team has correct data replicas but a manual failover takes six hours, exceeding its target.
B:Fresh replicas improve potential recovery-point loss, not the six hours consumed by manual failover. The violated RTO calls for an ordered, rehearsed recovery plan and automation of safe application startup and cutover.
C:Failover uses replicated state in the recovery region to start supported workloads. A regional outage may require unplanned failover.
Question 401
A partner's guest profile is visible, but default guest directory visibility is broader than the security policy allows. Which Entra control is relevant?
- Treat permanent deletion as non-restorable through ordinary Entra soft-delete recovery.
- Configure external collaboration guest access restrictions for directory visibility.
- Review authorized external collaboration domain restrictions before attempting the invite.
- Assign Azure resource-group Reader to the guest to limit which Microsoft Entra directory users they can discover.
Explanation
Correct Answer
B:Guest restrictions govern how much directory information external identities can discover. App permissions and B2B authentication are separate controls. This matters here because a partner's guest profile is visible, but default guest directory visibility is broader than the security policy….
Incorrect Answers
A:Recreating a matching display name cannot recover an expired deleted object ID. Reprovisioning then requires explicit reauthorization and rebuilding impacted references.
C:B2B invitation eligibility is determined by tenant policy. An invitation cannot bypass an explicit approved domain block. This matters here because a partner's guest profile is visible, but default guest directory visibility is broader than the security policy….
D:Azure RBAC Reader controls Azure resource management visibility, not the guest user directory-visibility setting. Inspect Microsoft Entra external-user and directory permission controls instead.
Question 402
An administrator thinks Azure resource Reader will prevent an external guest from viewing other Entra users. Which control should be checked instead?
- Inspect tenant guest-user access restrictions and effective directory roles.
- Grant the guest Azure subscription Reader and assume it restricts directory browsing to authorized people.
- Inspect the enterprise application's User assignment required setting and its assigned users or groups.
- Assume Azure subscription Reader controls which Entra directory user objects a B2B guest can browse.
Explanation
Correct Answer
A:Azure resource-management RBAC is not the same authorization plane as directory browsing. Guest directory visibility is managed by Entra policies and roles. This matters here because an administrator thinks Azure resource Reader will prevent an external guest from viewing other Entra users. Which….
Incorrect Answers
B:Subscription Reader concerns Azure management-plane resources, not the Microsoft Entra guest directory view. External collaboration restrictions and directory role visibility are evaluated separately.
C:When assignment is required, a valid guest credential alone is insufficient. Membership or explicit application assignment must authorize the target user. This matters here because an administrator thinks Azure resource Reader will prevent an external guest from viewing other Entra users. Which….
D:Resource-plane Azure Reader does not define tenant-wide guest directory visibility. Review Entra external collaboration guest access restrictions and any direct directory roles assigned to the guest.
Question 403
A cloud user was mistakenly deleted last week and their original object relationships need recovering. Which operation should be attempted first?
- Use the unique Entra object ID to identify the exact directory user.
- Restore the existing Entra user from deleted users within the applicable retention window.
- Create a replacement user with the same display name instead of restoring the deleted directory object.
- Grant a newly recreated user the old app group and claim this restores the deleted directory object's immutable ID.
Explanation
Correct Answer
B:Soft-deleted users can often be restored before expiry, preserving their original object rather than creating a new principal with different references.
Incorrect Answers
A:A display name is not guaranteed unique. Object IDs target one directory principal even when names collide.
C:A recreated account has a different directory object ID and may lose prior assignments. Within the retention period, restore the original object to preserve its identity relationships.
D:A replacement identity is not the original user object, even if group access is recreated. Within the supported window, first restore the deleted user and review original relationships.
Question 404
The administrator is unable to restore a deleted identity because its retention window has expired. What should be documented?
- Assume the expired deleted-user object can still be restored automatically without rebuilding assignments.
- Check accountEnabled and deleted-users status before creating another principal.
- Recreate the user and claim the expired original soft-deleted objectId has been restored.
- Treat permanent deletion as non-restorable through ordinary Entra soft-delete recovery.
Explanation
Correct Answer
D:Recreating a matching display name cannot recover an expired deleted object ID. Reprovisioning then requires explicit reauthorization and rebuilding impacted references. This matters here because the administrator is unable to restore a deleted identity because its retention window has expired.
Incorrect Answers
A:Once the deletion retention window has expired, restoring that directory object may no longer be supported. Reprovisioning and documenting the loss of object-specific references are different from an in-window restore.
B:A blocked account is still a directory object. Recreating it risks duplicate identities and does not repair a simple sign-in restriction.
C:Beyond the restore window a new directory user has a different immutable identifier. Document affected authorizations and dependencies instead of treating reconstruction as restoration.
Question 405
An operations team needs to provision hundreds of Entra users consistently from validated HR records. Which supported automation interface fits?
- Use the unique Entra object ID to identify the exact directory user.
- Use Microsoft Graph with appropriately scoped permissions and input validation for user provisioning.
- Separate licensing group membership from privileged Azure resource-management groups.
- Add the trusted domain to the Entra B2B allowed-domain configuration under approved policy.
Explanation
Correct Answer
B:The Microsoft Graph API supports directory user creation and updates under delegated or application authorization. Validation and failure reporting are needed for bulk operations.
Incorrect Answers
A:A display name is not guaranteed unique. Object IDs target one directory principal even when names collide. This matters here because an operations team needs to provision hundreds of Entra users consistently from validated HR records. Which….
C:License eligibility should not automatically give members resource-admin rights. Separating purposes makes membership changes less dangerous. This matters here because an operations team needs to provision hundreds of Entra users consistently from validated HR records. Which….
D:An invitation allowlist permits explicitly trusted domains and constrains broader collaboration. Granting Azure Reader does not authorize a blocked identity invitation.
Question 406
A bulk provisioning job creates duplicate-looking users after retries. Which identifier should be reconciled?
- Use the unique Entra object ID to identify the exact directory user.
- Create a new application assignment on every retry without comparing the immutable employee and directory identifiers.
- Add appropriate accountable group owners rather than distributing tenant-wide administrator roles.
- Check immutable employee identifiers and the exact Entra user object IDs before replaying writes.
Explanation
Correct Answer
D:Idempotent matching prevents a retry from creating a second principal for the same employee. Display names are not unique reliable keys. This matters here because a bulk provisioning job creates duplicate-looking users after retries. Which identifier should be reconciled.
Incorrect Answers
A:A display name is not guaranteed unique. Object IDs target one directory principal even when names collide. This matters here because a bulk provisioning job creates duplicate-looking users after retries. Which identifier should be reconciled.
B:Repeated app entitlements cannot reconcile a duplicated identity. Match a stable HR identifier and existing Entra object IDs before provisioning again.
C:Delegating one group's administration reduces tenant-wide privileges and allows the intended membership changes without expanding directory administration scope. This matters here because a bulk provisioning job creates duplicate-looking users after retries. Which identifier should be reconciled.
Question 407
A department wants automatic inclusion of employees in a group based on their country and jobTitle fields. Which membership construct fits?
- Create a dynamic user security group with a supported department membership expression.
- Have the help desk manually populate a dynamic group after every country and job-title change.
- Use a dynamic user membership expression combining supported attributes with Boolean logic.
- Check the domain verification TXT record at its authoritative public DNS host.
Explanation
Correct Answer
C:Dynamic rules can combine conditions over supported Entra user properties. Each operand must use correct attribute names and supported operators.
Incorrect Answers
A:Entra evaluates supported user attributes and updates dynamic group membership when identities match the expression. A static group cannot track attribute changes automatically. This matters here because a department wants automatic inclusion of employees in a group based on their country and jobTitle fields. Which….
B:Manual updates defeat the automatic membership requirement and aren't how dynamic group membership is managed. Define a supported user-attribute expression and let Entra evaluate it.
D:Entra tests the published verification challenge for the domain; an email address or an internal DNS entry does not prove the tenant controls the required DNS zone. This matters here because a department wants automatic inclusion of employees in a group based on their country and jobTitle fields. Which….
Question 408
A complex dynamic group rule runs but includes users from an unintended country. What should the reviewer inspect?
- Rewrite the user's job title while leaving the dynamic group's country clause and Boolean parentheses unreviewed.
- Change Entra user role assignments instead of inspecting the dynamic rule's Boolean conditions and attribute values.
- Check the principal type and object ID for the role-assignment assignee.
- Inspect rule parentheses, logical operator precedence, and evaluated user attributes.
Explanation
Correct Answer
D:Boolean grouping affects dynamic rule outcomes. A rule that mixes AND and OR without the intended grouping may match broader users than the department requested. This matters here because a complex dynamic group rule runs but includes users from an unintended country.
Incorrect Answers
A:An unexpected country match is often a logical expression or data-value problem. Verify the country attribute, precedence and grouping of OR/AND conditions rather than altering an unrelated job-title value.
B:Administrative role assignment does not correct an overly broad country predicate. Check rule parentheses, operators, country and jobTitle values, and effective evaluation results.
C:ServicePrincipal objects represent workloads while User objects represent people. Role descriptions alone are insufficient to infer who actually holds access.
Question 409
An admin sees a custom role in one subscription but cannot assign it in another. What should they check?
- Compare the two groups' inherited and direct effective role assignments.
- Review the custom role assignableScopes list and target subscription hierarchy.
- Assign an appropriate Key Vault Secrets User role at the intended vault or secret scope.
- Confirm Key Vault's RBAC permission model and the user's secret data-plane role.
Explanation
Correct Answer
B:The role may not be available for assignment outside the specified permitted scopes. Its name alone is not proof of cross-subscription assignability.
Incorrect Answers
A:An assignment on one resource group does not automatically cover a sibling group. The shared subscription alone does not imply shared privileges. This matters here because an admin sees a custom role in one subscription but cannot assign it in another.
C:An Azure resource Reader can see vault properties but not secret values. Key Vault data-plane roles authorize secret operations. This matters here because an admin sees a custom role in one subscription but cannot assign it in another.
D:The resource-management plane and vault secret data operations are distinct. A vault may require Key Vault Secrets User or another specifically authorized data-plane role. This matters here because an admin sees a custom role in one subscription but cannot assign it in another.
Question 410
An automation script must give a precise role to one service principal whose display name matches other entries. Which identifier should it use?
- Select the first matching service principal display name rather than the unique object ID in automation.
- Specify the service principal's immutable Entra object ID as the assignee.
- Assign an appropriate Key Vault Secrets User role at the intended vault or secret scope.
- Resolve the user's Entra principal object ID and tenant before creating the RBAC assignment.
Explanation
Correct Answer
B:Principal object IDs uniquely address the directory entity. Matching a friendly display name can select the wrong workload identity.
Incorrect Answers
A:Display names are not unique directory keys. Use the immutable assignee object ID to prevent granting a role to the wrong workload.
C:An Azure resource Reader can see vault properties but not secret values. Key Vault data-plane roles authorize secret operations. This matters here because an automation script must give a precise role to one service principal whose display name matches other entries.….
D:Email aliases and display names may change or collide. The resolved principal ID is the stable assignment target.
