Microsoft AZ-104 Practice Test 42
Question 410
An automation script must give a precise role to one service principal whose display name matches other entries. Which identifier should it use?
- Select the first matching service principal display name rather than the unique object ID in automation.
- Specify the service principal's immutable Entra object ID as the assignee.
- Assign an appropriate Key Vault Secrets User role at the intended vault or secret scope.
- Resolve the user's Entra principal object ID and tenant before creating the RBAC assignment.
Explanation
Correct Answer
B:Principal object IDs uniquely address the directory entity. Matching a friendly display name can select the wrong workload identity.
Incorrect Answers
A:Display names are not unique directory keys. Use the immutable assignee object ID to prevent granting a role to the wrong workload.
C:An Azure resource Reader can see vault properties but not secret values. Key Vault data-plane roles authorize secret operations. This matters here because an automation script must give a precise role to one service principal whose display name matches other entries.….
D:Email aliases and display names may change or collide. The resolved principal ID is the stable assignment target.
Question 411
A role assignment was created for the wrong same-named application. What should be compared?
- Compare the assignment principal ID against directory deleted objects and surviving service principals.
- Compare the exact principalId and principalType against the intended service principal.
- Verify that inherited Reader permissions flow from the containing resource group to child resources.
- Assign Contributor to the engineer at the team resource-group scope.
Explanation
Correct Answer
B:Application display names can collide. Azure RBAC evaluates assignment to object IDs and principal types, not human-readable labels.
Incorrect Answers
A:RBAC references can outlive removal of the directory object. Reusing the deleted user's friendly name is not reliable evidence of its identity. This matters here because a role assignment was created for the wrong same-named application.
C:Azure RBAC assignments at a parent scope are inherited by descendants, including new resources, so individual VM Reader grants are unnecessary. This matters here because a role assignment was created for the wrong same-named application.
D:Contributor manages supported Azure resources but does not include role-assignment administration. The assignment should be limited to the group's operational boundary. This matters here because a role assignment was created for the wrong same-named application.
Question 412
An admin wants to learn who modified Azure RBAC yesterday, including the actor and time. Which evidence source applies?
- Use an applicable Azure deny assignment where created by supported Azure services.
- Delegate separate RBAC assignment administration only if approved, using a suitable scoped access role.
- Query Azure Activity Log for Microsoft.Authorization/roleAssignments/write operations.
- Use resource-management roles without Microsoft.Authorization/roleAssignments/write.
Explanation
Correct Answer
C:Role-assignment updates are Azure control-plane events recorded with operation details in the Activity Log. Current permissions do not reveal the historical actor. This matters here because an admin wants to learn who modified Azure RBAC yesterday, including the actor and time. Which evidence source applies.
Incorrect Answers
A:Deny assignments restrict actions even if a role permits them. They are not ordinary user-created substitute roles and have distinct management rules. This matters here because an admin wants to learn who modified Azure RBAC yesterday, including the actor and time. Which evidence source applies.
B:Resource modification rights do not imply authority to grant permissions. Role Based Access Control Administrator or User Access Administrator covers assignment tasks under appropriate conditions. This matters here because an admin wants to learn who modified Azure RBAC yesterday, including the actor and time. Which evidence source applies.
D:Operational compute control and access delegation are different Azure management actions. A role that lacks assignment write cannot grant roles solely because it can start a VM. This matters here because an admin wants to learn who modified Azure RBAC yesterday, including the actor and time. Which evidence source applies.
Question 413
An assignment exists but no one can recall when it was granted. How should investigators locate provenance?
- Filter Activity Log by authorization provider operation, target scope, and event time.
- Verify that inherited Reader permissions flow from the containing resource group to child resources.
- Use an approved time-bounded Azure RBAC assignment at the smallest scope.
- Review only current Reader assignments on the resource group to determine the original role-assignment event time.
Explanation
Correct Answer
A:Historical control-plane records identify operations and actors. Inspecting only the current IAM list will not show past change events. This matters here because an assignment exists but no one can recall when it was granted.
Incorrect Answers
B:Azure RBAC assignments at a parent scope are inherited by descendants, including new resources, so individual VM Reader grants are unnecessary. This matters here because an assignment exists but no one can recall when it was granted.
C:Temporary privileged access reduces long-lived exposure. Record an owner and revoke or expire the assignment when the response is complete. This matters here because an assignment exists but no one can recall when it was granted.
D:A current assignment listing describes effective grants, not necessarily when a historical access change occurred. Inspect relevant Azure Activity Log and audit records for provenance.
Question 414
A subscription contains three resource groups; only one application team should administer its own VM resources. Where should the group's role be assigned?
- Scope the selected team's VM management role to its application resource group.
- Inspect role assignments at the management group and applicable parent hierarchy.
- Review the custom role assignableScopes list and target subscription hierarchy.
- Assign Reader at the appropriate management-group scope.
Explanation
Correct Answer
A:Grant the application team's VM management role at its particular resource group, so siblings remain outside the grant. Subscription-level Contributor would unnecessarily include all three application environments.
Incorrect Answers
B:A subscription's location in the management group tree determines its ancestor role assignments. A move can change effective inherited permissions.
C:The role may not be available for assignment outside the specified permitted scopes. Its name alone is not proof of cross-subscription assignability. This matters here because a subscription contains three resource groups; only one application team should administer its own VM resources.
D:Roles granted on a management-group ancestor can be inherited by descendant subscriptions and resources. This is broader than a single resource-group grant. This matters here because a subscription contains three resource groups; only one application team should administer its own VM resources.
Question 415
A team sees a VM in a different group but cannot stop it even though both are in one subscription. What explains the difference?
- Review the custom role assignableScopes list and target subscription hierarchy.
- Assign Reader on the first VM group and assume it enables start and stop operations on a different group.
- Compare the two groups' inherited and direct effective role assignments.
- Combine applicable direct, group-derived, and inherited Azure RBAC grants.
Explanation
Correct Answer
C:An assignment on one resource group does not automatically cover a sibling group. The shared subscription alone does not imply shared privileges. This matters here because a team sees a VM in a different group but cannot stop it even though both are in one subscription. What explains the….
Incorrect Answers
A:The role may not be available for assignment outside the specified permitted scopes. Its name alone is not proof of cross-subscription assignability. This matters here because a team sees a VM in a different group but cannot stop it even though both are in one subscription. What explains the….
B:Reader is read-only and role scope does not automatically include sibling resource groups. Check the principal’s write permissions and effective scope for the specific VM.
D:Azure RBAC generally adds the allowed actions from applicable assignments, subject to deny assignments and other controls. Reviewing only the direct role undercounts access. This matters here because a team sees a VM in a different group but cannot stop it even though both are in one subscription. What explains the….
Question 416
A cost report shows high spending but no actionable resizing proposal. Which report should be consulted?
- Verify tagging on each billable resource and cost-data tag support.
- Check billing scope, charge type, currency and period boundaries used by the report.
- Inspect Advisor recommendations and the workload utilization evidence supporting them.
- Inspect the VM tags directly and the existence of a tag-inheritance policy.
Explanation
Correct Answer
C:Historical costs quantify spend, while Advisor may suggest technical changes to underutilized resources. Recommendations still require workload validation. This matters here because a cost report shows high spending but no actionable resizing proposal. Which report should be consulted.
Incorrect Answers
A:Resource group tags are not automatically inherited by children. Some billing entries cannot be attributed by particular tags. This matters here because a cost report shows high spending but no actionable resizing proposal. Which report should be consulted.
B:Invoice and usage views may differ when discounts, tax, currency or time windows are applied. Comparing unaligned scopes produces misleading totals.
D:Tagging the parent group is not equivalent to tagging each child. Cost reporting by resource tag needs metadata on the actual billable resource. This matters here because a cost report shows high spending but no actionable resizing proposal. Which report should be consulted.
Question 417
A billing administrator needs to compare last month's charges between four subscriptions. Which portal analysis view is appropriate?
- Create an Azure Cost Management budget with threshold notifications.
- Use Azure Cost Management Cost analysis grouped by subscription.
- Use the Azure Policy exemption inventory as the financial view for month-by-month charges across subscriptions.
- Correlate the current lock with Activity Log lock-management events at its scope.
Explanation
Correct Answer
B:Cost analysis supports date filters and subscription groupings. The Activity Log records management operations instead of authoritative cost totals.
Incorrect Answers
A:Budgets track accumulated or forecast cost and notify at configured percentages. They do not universally stop running resources when exceeded. This matters here because a billing administrator needs to compare last month's charges between four subscriptions. Which portal analysis view….
C:Policy exemptions describe governance exceptions, not consumption spend. Use Cost Management Cost analysis with subscription grouping and the requested period.
D:The lock's visible current properties do not by themselves identify historical actors. Operation records supply change provenance where retained. This matters here because a billing administrator needs to compare last month's charges between four subscriptions. Which portal analysis view….
Question 418
Cost analysis totals differ from an invoice because of period and scope filters. What should be reconciled?
- Create a supported Cost Management budget filtered to the target application tag or scope.
- Check Azure Activity Log for Microsoft.Authorization/locks write or delete operations.
- Inspect the VM tags directly and the existence of a tag-inheritance policy.
- Check billing scope, charge type, currency and period boundaries used by the report.
Explanation
Correct Answer
D:Invoice and usage views may differ when discounts, tax, currency or time windows are applied. Comparing unaligned scopes produces misleading totals. This matters here because cost analysis totals differ from an invoice because of period and scope filters.
Incorrect Answers
A:Budget filters can focus cost reporting for supported tags and scopes. A global subscription threshold would include unrelated consumption. This matters here because cost analysis totals differ from an invoice because of period and scope filters.
B:Resource lock changes are Azure control-plane operations that can be traced to authorized callers. VM guest logs do not capture this operation reliably.
C:Tagging the parent group is not equivalent to tagging each child. Cost reporting by resource tag needs metadata on the actual billable resource. This matters here because cost analysis totals differ from an invoice because of period and scope filters.
Question 419
A project wants one resource container for a shared application lifecycle and policies. Which Azure object should hold the resources?
- Create an Azure Policy initiative containing the required policy definitions.
- Attach the CanNotDelete lock at the database resource scope.
- Create a resource group for resources with a shared lifecycle.
- Place resource names in one common tag and assume a tag gives them a shared deployment, access and deletion lifecycle.
Explanation
Correct Answer
C:Resource groups collect related assets for administration and deletion as a unit. They are not an availability or replication boundary. This matters here because a project wants one resource container for a shared application lifecycle and policies. Which Azure object should….
Incorrect Answers
A:Initiatives group definitions for assignment and aggregate compliance reporting. Resource locks do not combine definitions into policy packages. This matters here because a project wants one resource container for a shared application lifecycle and policies. Which Azure object should….
B:A resource-specific lock protects only the selected asset instead of every descendant in the resource group. Parent locks could have a wider blast radius.
D:A tag can aid inventory and cost analysis, but it is not the ARM resource container or a scope for resource-group deployments and locks. Create the shared application resource group instead.
Question 420
An operator removes a resource group and asks why its contained storage account disappeared. What rule explains this?
- Create an Azure Policy initiative containing the required policy definitions.
- Attach the CanNotDelete lock at the database resource scope.
- Check quota limits and access assignments in the destination subscription.
- Resource-group deletion also initiates deletion of its contained resources, subject to protections.
Explanation
Correct Answer
D:Resource group lifetime governs the resources inside. Locks and dependencies may prevent or complicate removal, so deletion must be reviewed carefully.
Incorrect Answers
A:Initiatives group definitions for assignment and aggregate compliance reporting. Resource locks do not combine definitions into policy packages. This matters here because an operator removes a resource group and asks why its contained storage account disappeared. What rule explains this.
B:A resource-specific lock protects only the selected asset rather than every descendant in the resource group. Parent locks could have a wider blast radius. This matters here because an operator removes a resource group and asks why its contained storage account disappeared. What rule explains this.
C:Subscription moves can change available quotas and effective administrative scopes. The destination does not automatically inherit all operational limits of the source subscription. This matters here because an operator removes a resource group and asks why its contained storage account disappeared. What rule explains this.
