Microsoft AZ-104 Practice Test 43
Question 420
An operator removes a resource group and asks why its contained storage account disappeared. What rule explains this?
- Create an Azure Policy initiative containing the required policy definitions.
- Attach the CanNotDelete lock at the database resource scope.
- Check quota limits and access assignments in the destination subscription.
- Resource-group deletion also initiates deletion of its contained resources, subject to protections.
Explanation
Correct Answer
D:Resource group lifetime governs the resources inside. Locks and dependencies may prevent or complicate removal, so deletion must be reviewed carefully.
Incorrect Answers
A:Initiatives group definitions for assignment and aggregate compliance reporting. Resource locks do not combine definitions into policy packages. This matters here because an operator removes a resource group and asks why its contained storage account disappeared. What rule explains this.
B:A resource-specific lock protects only the selected asset rather than every descendant in the resource group. Parent locks could have a wider blast radius. This matters here because an operator removes a resource group and asks why its contained storage account disappeared. What rule explains this.
C:Subscription moves can change available quotas and effective administrative scopes. The destination does not automatically inherit all operational limits of the source subscription. This matters here because an operator removes a resource group and asks why its contained storage account disappeared. What rule explains this.
Question 421
A resource group is created in East US but contains a VM in West US. Why is this configuration possible?
- Review the dependent-resource set required for the selected Azure resource move.
- Allow the resource group's metadata region to differ from its individual resources' regions.
- Request an eligible quota increase in the deployment region and VM family or select a permitted alternative.
- Apply consistent resource tags for businessUnit and environment to relevant resources.
Explanation
Correct Answer
B:A resource group's chosen location stores its metadata. Supported contained resources may be deployed to other locations, subject to policy and service constraints. This matters here because a resource group is created in East US but contains a VM in West US. Why is this configuration possible.
Incorrect Answers
A:Resource-group moves can require coordinated relocation of linked resources. Moving one component without required dependencies may be unsupported.
C:Regional quota cannot be borrowed from an unrelated region. A request must target the limiting resource family and scope.
D:Tags provide dimensions for grouping costs where billing meters support them. A display name alone is an unreliable allocation category. This matters here because a resource group is created in East US but contains a VM in West US. Why is this configuration possible.
Question 422
A user attempts to change a group's location to relocate all VMs and sees no such migration operation. What is the correction?
- Use supported resource migration workflows to relocate workloads; a resource group's metadata location does not move VMs.
- Resource-group deletion also initiates deletion of its contained resources, subject to protections.
- Review ReadOnly locks inherited from resource group or subscription scopes.
- Check quota limits and access assignments in the destination subscription.
Explanation
Correct Answer
A:Changing a resource group container or name is not a VM region move. Compute relocation requires service-appropriate migration or recreation.
Incorrect Answers
B:Resource group lifetime governs the resources inside. Locks and dependencies may prevent or complicate removal, so deletion must be reviewed carefully. This matters here because a user attempts to change a group's location to relocate all VMs and sees no such migration operation. What is the….
C:An Azure lock can block management operations even when the user holds Owner. The authorized lock owner must remove or adjust it before the write. This matters here because a user attempts to change a group's location to relocate all VMs and sees no such migration operation. What is the….
D:Subscription moves can change available quotas and effective administrative scopes. The destination does not automatically inherit all operational limits of the source subscription. This matters here because a user attempts to change a group's location to relocate all VMs and sees no such migration operation. What is the….
Question 423
A platform engineer wants to move a storage resource between groups without changing its region. What must be verified before moving?
- Check the resource provider's move support, dependencies, locks and target scope.
- Start with Azure Policy audit effect and inspect compliance impact before enabling deny.
- Use an Azure Policy audit effect on the relevant resource properties.
- Treat the new 800-question V2 target as a separate draft requirement, preserving prior artifact provenance.
Explanation
Correct Answer
A:Some Azure resources or configurations cannot be moved between groups without prerequisites. Validation reduces broken dependencies. This matters here because a platform engineer wants to move a storage resource between groups without changing its region.
Incorrect Answers
B:Audit can reveal existing violations without blocking new work. The organization can fix affected resources before switching to enforcement. This matters here because a platform engineer wants to move a storage resource between groups without changing its region.
C:Audit records noncompliance while allowing operations to proceed. Deny would prevent resources that violate the configured rule. This matters here because a platform engineer wants to move a storage resource between groups without changing its region.
D:Historical releases and current production targets must not be conflated. Auditability requires keeping the prior version intact until a new verified 800-question Final exists. This matters here because a platform engineer wants to move a storage resource between groups without changing its region.
Question 424
A resource move validation fails because the VM's dependent NIC was omitted. What should be included?
- Compare the newly drafted V2 question count and validation status against 800 before approving Final.
- Use Azure Policy tag inheritance or modification because resource tags do not automatically inherit.
- Use an Azure Policy deny effect with allowed locations configured.
- Review the dependent-resource set required for the selected Azure resource move.
Explanation
Correct Answer
D:Resource-group moves can require coordinated relocation of linked resources. Moving one component without required dependencies may be unsupported. This matters here because a resource move validation fails because the VM's dependent NIC was omitted.
Incorrect Answers
A:A historical release cannot prove a new owner target is complete. Verified quantities and QA are independent release conditions. This matters here because a resource move validation fails because the VM's dependent NIC was omitted.
B:Resource group tags do not automatically copy to child resources. An appropriate policy is required to apply or enforce matching metadata. This matters here because a resource move validation fails because the VM's dependent NIC was omitted.
C:A deny policy can block noncompliant Resource Manager requests before creation. Dashboard alerts do not enforce deployment constraints. This matters here because a resource move validation fails because the VM's dependent NIC was omitted.
Question 425
A managed identity receives HTTP 403 for blob downloads while ARM resource listing succeeds. What should be checked?
- Inspect effective Blob Data role grants and the access token's resource audience.
- Use data-plane Microsoft Entra authentication without requiring account key listing permissions.
- Add an Azure Files SMB permission while the workload still lacks the required Blob data-plane role.
- Check permissions for generating a user delegation key in addition to blob data access.
Explanation
Correct Answer
A:ARM resource management and blob content access are separate authorization paths. Correct scope and the storage data audience matter. This matters here because a managed identity receives HTTP 403 for blob downloads while ARM resource listing succeeds.
Incorrect Answers
B:Managed identity can request storage data access under its Blob Data role. Reading shared keys is a separate broad ARM management operation. This matters here because a managed identity receives HTTP 403 for blob downloads while ARM resource listing succeeds.
C:Successful ARM resource listing only proves management-plane read access. Blob Get operations need eligible Blob data privileges as well as permitted network connectivity.
D:The delegation-key operation and blob data operation can require distinct role permissions. Management Reader alone is not sufficient. This matters here because a managed identity receives HTTP 403 for blob downloads while ARM resource listing succeeds.
Question 426
An Azure Files share should use employees' directory sign-in rather than a shared storage account key. Which model is required?
- Assign an appropriate Storage Blob Data role to the workload identity at the required scope.
- Sign SMB access with a blob user delegation SAS and treat it as the employee's Windows directory credential.
- Rotate the compromised storage access key and migrate dependent clients to valid replacement credentials.
- Configure supported Azure Files identity-based SMB authentication and share-level authorization.
Explanation
Correct Answer
D:The requirement is directory-based SMB access to Azure Files rather than shared account keys. Configure a supported domain or Microsoft Entra-backed identity model and verify both share-level and file-system permissions.
Incorrect Answers
A:Entra-based blob operations depend on data-plane permissions. A management-only Reader assignment cannot grant content reads. This matters here because an Azure Files share should use employees' directory sign-in rather than a shared storage account key. Which model….
B:A Blob Storage user delegation SAS is not an identity-based SMB logon. Azure Files requires a supported directory authentication configuration plus share-level permissions and any applicable file ACLs.
C:A leaked shared key grants broad access and requires revocation. Staged client migration and key regeneration reduce the outage window. This matters here because an Azure Files share should use employees' directory sign-in rather than a shared storage account key. Which model….
Question 427
A user successfully authenticates to the share but cannot open a particular folder. What should be inspected?
- Identify whether the client relies on account-key-signed SAS rather than Entra-backed authorization.
- Check file and directory NTFS permissions in addition to the share-level role.
- Check permissions for generating a user delegation key in addition to blob data access.
- Inspect the signed permissions and resource scope; list is intentionally omitted.
Explanation
Correct Answer
B:SMB identity-based authorization can involve both share-level RBAC and filesystem ACLs. One passing layer does not override another. This matters here because a user successfully authenticates to the share but cannot open a particular folder.
Incorrect Answers
A:Account SAS depends on shared-key authorization. User delegation SAS and supported Entra authorization use different mechanisms. This matters here because a user successfully authenticates to the share but cannot open a particular folder.
C:The delegation-key operation and blob data operation can require distinct role permissions. Management Reader alone is not sufficient. This matters here because a user successfully authenticates to the share but cannot open a particular folder.
D:A SAS grants only the operations and resource types it signs. Upload permission does not implicitly confer container enumeration. This matters here because a user successfully authenticates to the share but cannot open a particular folder.
Question 428
A company accidentally exposed one storage account key and wants to invalidate it without disrupting every client at once. What process should be followed?
- Enable Secure transfer required on the Azure storage account.
- Inspect private DNS zone virtual-network links and any conditional resolver forwarding.
- Rotate the compromised storage access key and migrate dependent clients to valid replacement credentials.
- Disable shared key authorization where supported and migrate clients to Entra or user delegation SAS.
Explanation
Correct Answer
C:A leaked shared key grants broad access and requires revocation. Staged client migration and key regeneration reduce the outage window. This matters here because a company accidentally exposed one storage account key and wants to invalidate it without disrupting every client at….
Incorrect Answers
A:The secure-transfer flag requires HTTPS for supported storage requests. Encryption at rest protects a different data state. This matters here because a company accidentally exposed one storage account key and wants to invalidate it without disrupting every client at….
B:Private DNS linkage and forwarding determine which networks receive private answers. A connected endpoint alone does not propagate records to every VNet.
D:Disabling shared-key authorization limits account-key-based access paths and encourages identity-based authorization. Compatibility must be tested. This matters here because a company accidentally exposed one storage account key and wants to invalidate it without disrupting every client at….
Question 429
After regenerating key1, some legacy applications fail but other clients continue. What should be checked?
- Assign an appropriate Storage Blob Data role to the workload identity at the required scope.
- Inventory which clients still use key1 rather than key2 or identity-based access.
- Inspect the browser preflight request and storage CORS response headers.
- Change Azure Files directory ACLs to fix callers that still use a regenerated storage account access key.
Explanation
Correct Answer
B:Applications pinned to a regenerated key fail authentication until updated. Having two keys enables a controlled rotation pattern.
Incorrect Answers
A:Entra-based blob operations depend on data-plane permissions. A management-only Reader assignment cannot grant content reads. This matters here because after regenerating key1, some legacy applications fail but other clients continue.
C:Browsers enforce cross-origin policy while command-line clients normally do not. The difference can arise even in cases where the underlying authentication succeeds.
D:SMB file permissions cannot repair a client configured with a rotated shared key. Identify clients using old key1 credentials and update their secret or authentication approach.
Question 430
A short-lived SAS should work only from a defined corporate public IP block. Which token field is useful?
- Set the SAS signed IP range restriction where that SAS type supports it.
- Set the signed resource, read permission and start/expiry times to the minimum necessary scope.
- Set the signed SAS protocol field to HTTPS only.
- Check TCP port 445 reachability and intervening firewall or ISP rules.
Explanation
Correct Answer
A:SAS signed IP constraints restrict where the bearer token may be used in addition to its rights and lifetime. This matters here because a short-lived SAS should work only from a defined corporate public IP block. Which token field is useful.
Incorrect Answers
B:SAS capabilities are limited by signed resource and permission fields, as well as validity and optional network conditions. This matters here because a short-lived SAS should work only from a defined corporate public IP block. Which token field is useful.
C:A bearer SAS token can be exposed over insecure transport. Protocol restriction prevents use over unencrypted HTTP. This matters here because a short-lived SAS should work only from a defined corporate public IP block. Which token field is useful.
D:Correct DNS and private endpoint state do not guarantee SMB connectivity. Network filtering of TCP 445 can block mounting. This matters here because a short-lived SAS should work only from a defined corporate public IP block. Which token field is useful.
