Microsoft AZ-104 Practice Test 51
Question 500
After a successful ASR failover, the organization wants the original region to become primary again. Which lifecycle stage is relevant?
- Enable backup soft delete to reverse the Azure Site Recovery replication direction after failover.
- Configure supported geo-redundant backup storage with cross-region restore requirements where eligible.
- Reprotect the recovered workload and perform a supported failback sequence when the source is ready.
- Create an unrelated new backup policy instead of restoring replication direction to the original region.
Explanation
Correct Answer
C:Failback requires replication direction and target infrastructure readiness; the initial failover is not automatically reversible. This matters here because after a successful ASR failover, the organization wants the original region to become primary again. Which lifecycle….
Incorrect Answers
A:Soft delete protects certain deleted backup data; it is not a Site Recovery failback action. Reprotect, validate the original site and follow the supported failback sequence.
B:Geo redundancy can replicate supported backup data to a secondary region, subject to service options and replication delay.
D:A failback is not a standalone backup restore. After service is running in the recovery region, re-establish healthy protection in the reverse direction and follow the supported failback workflow when the former primary is ready.
Question 501
A help desk operator must reset ordinary non-admin employee passwords without gaining broad tenant administration. Which directory role is suitable?
- Enable the relevant service plan within the product license assignment.
- Scope self-service password reset to the appropriate Entra users and require authentication-method registration.
- Grant the appropriate scoped Password Administrator capability for the relevant users.
- Use Microsoft Entra directory administration roles rather than Azure subscription RBAC.
Explanation
Correct Answer
C:Password Administrator provides supported reset operations for nonprivileged users and certain supported role targets. A general subscription Contributor role cannot manage tenant passwords. This matters here because a help desk operator must reset ordinary non-admin employee passwords without gaining broad tenant administration.….
Incorrect Answers
A:Products can contain individual service plans that are enabled or disabled independently. Product ownership by itself does not prove every contained service is active. This matters here because a help desk operator must reset ordinary non-admin employee passwords without gaining broad tenant administration.….
B:SSPR enables eligible users to prove identity and reset their password without ticket handling. It requires correct scope and sufficient registered methods. This matters here because a help desk operator must reset ordinary non-admin employee passwords without gaining broad tenant administration.….
D:Directory password reset is a tenant identity operation; resource Contributor or Owner does not automatically confer permission to reset users. This matters here because a help desk operator must reset ordinary non-admin employee passwords without gaining broad tenant administration.….
Question 502
A Password Administrator cannot reset a highly privileged directory administrator using their usual permissions. What should be verified?
- Inspect the enterprise application's User assignment required setting and its assigned users or groups.
- Use Microsoft Entra directory administration roles rather than Azure subscription RBAC.
- Recognize the separation between Entra directory roles and Azure resource-management RBAC.
- Check password-reset role limitations for privileged targets before assigning a higher authorized support role.
Explanation
Correct Answer
D:Entra uses privilege boundaries for which directory roles can reset other accounts. Administering ordinary users does not imply authority over all privileged principals.
Incorrect Answers
A:When assignment is required, a valid guest credential alone is insufficient. Membership or explicit application assignment must authorize the target user. This matters here because a Password Administrator cannot reset a highly privileged directory administrator using their usual permissions.
B:Directory password reset is a tenant identity operation; resource Contributor or Owner does not automatically confer permission to reset users. This matters here because a Password Administrator cannot reset a highly privileged directory administrator using their usual permissions.
C:The Contributor role authorizes Azure management actions at scope. Identity tasks require separately delegated directory privileges. This matters here because a Password Administrator cannot reset a highly privileged directory administrator using their usual permissions.
Question 503
A security lead sees repeated failed logins for a user and needs to prevent new authentications while retaining evidence. Which reversible action fits?
- Review the user license and service-plan assignments while the sign-in block remains in place.
- Create a replacement member while leaving the compromised user's sign-in enabled during investigation.
- Block the user's sign-in in Entra and preserve the account for investigation.
- Determine the user's source of authority and update credentials through the synchronized identity system.
Explanation
Correct Answer
C:Blocking new sign-ins is a reversible identity action; it leaves the user object available for audit. Active tokens may require separate revocation. This matters here because a security lead sees repeated failed logins for a user and needs to prevent new authentications while retaining….
Incorrect Answers
A:Identity properties and license records can be examined independently of permitting interactive authentication. Reactivating the user is not required to check the assigned service plans.
B:A new account does not block authentication for the original principal. Block that user's sign-in, consider token/session revocation and preserve evidence as required.
D:Synchronized objects may have attributes controlled by their on-premises origin. Cloud-only administrative actions do not automatically override that authority boundary. This matters here because a security lead sees repeated failed logins for a user and needs to prevent new authentications while retaining….
Question 504
A blocked user has an existing application session that remains valid temporarily. What additional offboarding step is relevant?
- Review the user license and service-plan assignments while the sign-in block remains in place.
- Revoke the user's Entra sign-in sessions and review application-issued session lifetimes.
- Verify the blocked user still has an application assignment but leave their active refresh sessions untouched.
- Inspect the B2B guest's invitation redemption status and resend or reset redemption if appropriate.
Explanation
Correct Answer
B:Sign-in blocking governs new authentications and does not necessarily invalidate every previously issued session. Revocation and application session controls address remaining access. This matters here because a blocked user has an existing application session that remains valid temporarily. What additional offboarding step….
Incorrect Answers
A:Identity properties and license records can be examined independently of permitting interactive authentication. Reactivating the user is not required to check the assigned service plans. This matters here because a blocked user has an existing application session that remains valid temporarily. What additional offboarding step….
C:Assignments alone do not revoke already issued sign-in sessions. Explicitly revoke supported sessions and consider the app's own session lifetime.
D:Guest object creation does not prove acceptance of the invitation. Redemption state distinguishes pending invitation from a completed guest onboarding flow. This matters here because a blocked user has an existing application session that remains valid temporarily. What additional offboarding step….
Question 505
A company needs a directory group for security assignments rather than an email-only distribution recipient list. What group kind fits?
- Use the partner's home identity provider as the primary credential authority for B2B collaboration.
- Use Microsoft Entra directory administration roles rather than Azure subscription RBAC.
- Create a security-enabled Microsoft Entra group with assigned membership.
- Assign a suitable owner to that particular Entra group.
Explanation
Correct Answer
C:A security group is an appropriate principal for supported access assignments. A mail distribution group alone is not a substitute for authorization identity.
Incorrect Answers
A:The external identity's home organization manages its primary authentication, while the resource tenant manages its guest object and resource entitlements.
B:Directory password reset is a tenant identity operation; resource Contributor or Owner does not automatically confer permission to reset users. This matters here because a company needs a directory group for security assignments rather than an email-only distribution recipient list.….
D:Group ownership supports delegated group maintenance where the group type permits it. Global Administrator is unnecessarily broad for local membership edits. This matters here because a company needs a directory group for security assignments rather than an email-only distribution recipient list.….
Question 506
An Azure RBAC role-assignment dialog cannot select an ordinary distribution list as a security principal. What should be used?
- Assign a suitable owner to that particular Entra group.
- Check the principal type and object ID for the role-assignment assignee.
- Choose a mail-only distribution list with a matching display name as the Azure RBAC principal.
- Select an eligible Entra security principal such as a security group for Azure RBAC.
Explanation
Correct Answer
D:Azure RBAC applies roles to authorized Entra users, groups, service principals, or managed identities rather than arbitrary email lists.
Incorrect Answers
A:Group ownership supports delegated group maintenance where the group type permits it. Global Administrator is unnecessarily broad for local membership edits. This matters here because an Azure RBAC role-assignment dialog cannot select an ordinary distribution list as a security principal.
B:ServicePrincipal objects represent workloads while User objects represent people. Role descriptions alone are insufficient to infer who actually holds access. This matters here because an Azure RBAC role-assignment dialog cannot select an ordinary distribution list as a security principal.
C:A distribution list is not an eligible security principal for Azure resource role assignments. Choose a supported user, security group, managed identity or service principal.
Question 507
An application team needs a dedicated account to represent a nonhuman workload rather than a human employee. What identity type is relevant?
- Use a service principal or supported managed identity for the workload.
- Use a shared human member account to represent the nonhuman application and distribute its password to operators.
- Review the user license and service-plan assignments while the sign-in block remains in place.
- Look up the user's userPrincipalName rather than relying on displayName.
Explanation
Correct Answer
A:Applications and automation can authenticate as workload principals with scoped authorization, instead of borrowing a person's account.
Incorrect Answers
B:Shared human credentials add credential-management and attribution risk. Evaluate a managed identity or appropriately scoped service principal for the workload instead.
C:Identity properties and license records can be examined independently of permitting interactive authentication. Reactivating the user is not required to check the assigned service plans. This matters here because an application team needs a dedicated account to represent a nonhuman workload rather than a human employee. What….
D:UPN is an Entra user sign-in identifier and may differ from a human-readable display name. Display names can repeat or change. This matters here because an application team needs a dedicated account to represent a nonhuman workload rather than a human employee. What….
Question 508
A reviewer wants to determine whether a role is assigned to an application or a person. What Entra field should be inspected?
- Infer whether the RBAC assignee is a user or application from its editable display name alone.
- Check the principal type and object ID for the role-assignment assignee.
- Select an eligible Entra security principal such as a security group for Azure RBAC.
- Refer primary password reset to the supplier's home identity administrator or self-service process.
Explanation
Correct Answer
B:ServicePrincipal objects represent workloads while User objects represent people. Role descriptions alone are insufficient to infer who actually holds access. This matters here because a reviewer wants to determine whether a role is assigned to an application or a person. What Entra field should be….
Incorrect Answers
A:Display names can collide and do not reliably identify a principal type. Inspect its immutable object ID and type, such as user or service principal.
C:Azure RBAC applies roles to authorized Entra users, groups, service principals, or managed identities instead of arbitrary email lists.
D:The host resource tenant does not generally own an external corporate user's source credentials. Local guest management is not equivalent to home-tenant password authority. This matters here because a reviewer wants to determine whether a role is assigned to an application or a person. What Entra field should be….
Question 509
A business creates a new Entra group but its owner reports that no one can manage group members. What operational configuration should be reviewed?
- Enable the relevant service plan within the product license assignment.
- Assign explicit group owners and verify the group's membership model.
- Assign a suitable owner to that particular Entra group.
- Grant an arbitrary user subscription Contributor instead of assigning eligible owners to the Entra group.
Explanation
Correct Answer
B:Assigned and dynamic groups have different management methods. Group owners provide accountable delegated administration where supported. This matters here because a business creates a new Entra group but its owner reports that no one can manage group members. What operational….
Incorrect Answers
A:Products can contain individual service plans that are enabled or disabled independently. Product ownership by itself does not prove every contained service is active. This matters here because a business creates a new Entra group but its owner reports that no one can manage group members. What operational….
C:Group ownership supports delegated group maintenance where the group type permits it. Global Administrator is unnecessarily broad for local membership edits. This matters here because a business creates a new Entra group but its owner reports that no one can manage group members. What operational….
D:Azure resource management roles do not automatically grant Entra group membership administration. Confirm explicit group ownership and the group's assigned-versus-dynamic membership behavior.
Question 510
A new hire is added to a security group that holds Reader on a subscription. Which permission should they gain after propagation?
- Use resource-management roles without Microsoft.Authorization/roleAssignments/write.
- Combine applicable direct, group-derived, and inherited Azure RBAC grants.
- Verify that inherited Reader permissions flow from the containing resource group to child resources.
- Receive the group's inherited Reader authorization at subscription and child resource scopes.
Explanation
Correct Answer
D:Azure RBAC supports assigning roles to Entra groups. Eligible group members acquire the specified rights at the assignment scope. This matters here because a new hire is added to a security group that holds Reader on a subscription. Which permission should they gain after….
Incorrect Answers
A:Operational compute control and access delegation are different Azure management actions. A role that lacks assignment write cannot grant roles solely because it can start a VM. This matters here because a new hire is added to a security group that holds Reader on a subscription. Which permission should they gain after….
B:Azure RBAC generally adds the allowed actions from applicable assignments, subject to deny assignments and other controls. Reviewing only the direct role undercounts access. This matters here because a new hire is added to a security group that holds Reader on a subscription. Which permission should they gain after….
C:Azure RBAC assignments at a parent scope are inherited by descendants, including new resources, so individual VM Reader grants are unnecessary. This matters here because a new hire is added to a security group that holds Reader on a subscription. Which permission should they gain after….
