Microsoft AZ-104 Practice Test 61
Question 600
A backup team wants to know whether every critical VM has at least one recent successful recovery point. Which report should they inspect?
- Verify the vault's diagnostic routing to the reporting workspace and data ingestion delay.
- Inspect the backup job history, policy association, VM agent state and failure details.
- Daily recovery points can lose far more than one hour of recent changes.
- Review backup item protection status and latest successful recovery points for each VM.
Explanation
Correct Answer
D:Policy assignments describe intent, while actual recovery points show executed protection. Coverage checks need both. This matters here because a backup team wants to know whether every critical VM has at least one recent successful recovery point. Which….
Incorrect Answers
A:Central reporting depends on exported telemetry and timing. Successful local backup jobs do not automatically populate another workspace. This matters here because a backup team wants to know whether every critical VM has at least one recent successful recovery point. Which….
B:A policy configured on paper does not prove successful execution. Job outcomes and generated recovery points establish actual protection. This matters here because a backup team wants to know whether every critical VM has at least one recent successful recovery point. Which….
C:An RPO requirement must match recovery-point frequency and replication behavior. More frequent protection or replication may be needed. This matters here because a backup team wants to know whether every critical VM has at least one recent successful recovery point. Which….
Question 601
An Entra security group has no listed owners and is administered only by Global Administrators. What is the least-privileged correction?
- Check password-reset role limitations for privileged targets before assigning a higher authorized support role.
- Assign a suitable owner to that particular Entra group.
- Create a duplicate security group instead of assigning an owner to the existing group.
- Add appropriate accountable group owners rather than distributing tenant-wide administrator roles.
Explanation
Correct Answer
D:Delegating one group's administration reduces tenant-wide privileges and allows the intended membership changes without expanding directory administration scope. This matters here because an Entra security group has no listed owners and is administered only by Global Administrators. What is the….
Incorrect Answers
A:Entra uses privilege boundaries for which directory roles can reset other accounts. Administering ordinary users does not imply authority over all privileged principals. This matters here because an Entra security group has no listed owners and is administered only by Global Administrators. What is the….
B:Group ownership supports delegated group maintenance where the group type permits it. Global Administrator is unnecessarily broad for local membership edits. This matters here because an Entra security group has no listed owners and is administered only by Global Administrators. What is the….
C:Creating another group does not delegate administration of the original group or preserve its existing assignments. Grant appropriately scoped group ownership for the object that needs maintenance.
Question 602
A partner's home identity provider requires a different primary sign-in credential than the resource tenant. Which tenant controls that credential?
- Use the partner's home identity provider as the primary credential authority for B2B collaboration.
- Replace the guest's home-organization sign-in credential with a new resource-tenant password as the default fix.
- Look up the user's userPrincipalName rather than relying on displayName.
- Configure external collaboration guest access restrictions for directory visibility.
Explanation
Correct Answer
A:The external identity's home organization manages its primary authentication, while the resource tenant manages its guest object and resource entitlements. This matters here because a partner's home identity provider requires a different primary sign-in credential than the resource tenant. Which….
Incorrect Answers
B:B2B collaboration normally relies on the identity provider that authenticates the external user. Group membership inspection in the resource tenant does not change the home provider's credential authority.
C:UPN is an Entra user sign-in identifier and may differ from a human-readable display name. Display names can repeat or change. This matters here because a partner's home identity provider requires a different primary sign-in credential than the resource tenant. Which….
D:Guest restrictions govern how much directory information external identities can discover. App permissions and B2B authentication are separate controls. This matters here because a partner's home identity provider requires a different primary sign-in credential than the resource tenant. Which….
Question 603
A resource-tenant administrator attempts to reset a B2B supplier's home-company password. What boundary must be respected?
- Refer primary password reset to the supplier's home identity administrator or self-service process.
- Review available license seats and resolve group-based licensing assignment errors.
- Scope self-service password reset to the appropriate Entra users and require authentication-method registration.
- Confirm that guest removal affected the resource tenant, not the external user's home tenant.
Explanation
Correct Answer
A:The host resource tenant does not generally own an external corporate user's source credentials. Local guest management is not equivalent to home-tenant password authority. This matters here because a resource-tenant administrator attempts to reset a B2B supplier's home-company password. What boundary must be….
Incorrect Answers
B:Dynamic or assigned group membership cannot create additional purchased seats. Capacity and license-assignment status determine whether a service can be enabled. This matters here because a resource-tenant administrator attempts to reset a B2B supplier's home-company password. What boundary must be….
C:SSPR enables eligible users to prove identity and reset their password without ticket handling. It requires correct scope and sufficient registered methods. This matters here because a resource-tenant administrator attempts to reset a B2B supplier's home-company password. What boundary must be….
D:B2B identities are governed by two administrative boundaries: the resource tenant controls its guest authorization, while the home tenant continues to own primary credentials. This matters here because a resource-tenant administrator attempts to reset a B2B supplier's home-company password. What boundary must be….
Question 604
An operations policy prohibits using the same group for license assignment and broad subscription Owner grants. What first change limits risk?
- Review available license seats and resolve group-based licensing assignment errors.
- Separate licensing group membership from privileged Azure resource-management groups.
- Review whether the group is dynamic rather than assigned and change the underlying rule or attribute.
- Review authorized external collaboration domain restrictions before attempting the invite.
Explanation
Correct Answer
B:License eligibility should not automatically give members resource-admin rights. Separating purposes makes membership changes less dangerous. This matters here because an operations policy prohibits using the same group for license assignment and broad subscription Owner grants. What….
Incorrect Answers
A:Dynamic or assigned group membership cannot create additional purchased seats. Capacity and license-assignment status determine whether a service can be enabled. This matters here because an operations policy prohibits using the same group for license assignment and broad subscription Owner grants. What….
C:Dynamic groups derive membership from evaluated rules, so direct manual membership editing is not the normal method. Owner status does not override dynamic membership logic. This matters here because an operations policy prohibits using the same group for license assignment and broad subscription Owner grants. What….
D:B2B invitation eligibility is determined by tenant policy. An invitation cannot bypass an explicit approved domain block. This matters here because an operations policy prohibits using the same group for license assignment and broad subscription Owner grants. What….
Question 605
An employee added for a software license unexpectedly becomes subscription Owner through the same group. What should be corrected?
- Assign the product license through Entra group-based licensing.
- Assign the person to the authorized enterprise application or its eligible access group.
- Remove the privileged Azure RBAC assignment from the license group and use a dedicated access group.
- Fix the license group's usageLocation settings while leaving its broad subscription Owner assignment active.
Explanation
Correct Answer
C:Group-based licensing and Azure RBAC use distinct entitlements. Combining them can accidentally elevate ordinary licensing members. This matters here because an employee added for a software license unexpectedly becomes subscription Owner through the same group.
Incorrect Answers
A:Licensing groups attach supported Microsoft 365 or Entra product plans to eligible members and update assignments as membership changes. This matters here because an employee added for a software license unexpectedly becomes subscription Owner through the same group.
B:Account creation establishes identity but not necessarily application authorization. Assignment and app access policies can impose additional requirements.
D:License eligibility does not justify subscription-level Azure RBAC power. Remove the privileged role assignment from the group and separate licensing membership from administrative entitlement groups.
Question 606
A director must review all direct and inherited group memberships for a user before disabling an application. Which review is most complete?
- Inspect one directly assigned application group and assume nested group grants and all other direct entitlements are represented.
- Audit only one dynamic membership rule and assume it lists every group granting this user's application access.
- Scope self-service password reset to the appropriate Entra users and require authentication-method registration.
- Inspect the user's effective direct and transitive group membership in Entra.
Explanation
Correct Answer
D:Effective group access review should include direct memberships and any supported transitive paths that affect the consuming application. Identify each source and scope of authorization before disabling an app; do not assume only the group membership page is exhaustive.
Incorrect Answers
A:One group's membership does not enumerate every effective assignment. Review direct app assignments and all relevant user/group entitlements, accounting for application-specific nesting limits.
B:Access may flow from assigned groups, nested or transitive memberships, and direct application grants. Evaluating a single dynamic rule is insufficient for the complete entitlement review.
C:SSPR enables eligible users to prove identity and reset their password without ticket handling. It requires correct scope and sufficient registered methods. This matters here because a director must review all direct and inherited group memberships for a user before disabling an application. Which….
Question 607
An access audit reports a user is still authorized though absent from the app's directly assigned user list. What other route should be checked?
- Inspect rule parentheses, logical operator precedence, and evaluated user attributes.
- Check only the user's display name and ignore app-assigned security groups that could provide access.
- Refer primary password reset to the supplier's home identity administrator or self-service process.
- Inspect application-assigned group memberships and applicable nested membership semantics.
Explanation
Correct Answer
D:Access can be conferred through groups rather than an explicit user assignment. Evaluate the application's supported transitive membership behavior rather than assuming all nested groups work identically. This matters here because an access audit reports a user is still authorized though absent from the app's directly assigned user list. What….
Incorrect Answers
A:Boolean grouping affects dynamic rule outcomes. A rule that mixes AND and OR without the intended grouping may match broader users than the department requested. This matters here because an access audit reports a user is still authorized though absent from the app's directly assigned user list. What….
B:A missing direct user assignment does not rule out authorized group-based application assignment. Inspect effective enterprise-app assignments and the user's actual group memberships.
C:The host resource tenant does not generally own an external corporate user's source credentials. Local guest management is not equivalent to home-tenant password authority. This matters here because an access audit reports a user is still authorized though absent from the app's directly assigned user list. What….
Question 608
An identity admin needs to avoid confusion between a person's display name and sign-in name when troubleshooting an account. Which field identifies the usual sign-in name?
- Look up the user's userPrincipalName rather than relying on displayName.
- Configure external collaboration guest access restrictions for directory visibility.
- Use a service principal or supported managed identity for the workload.
- Treat displayName as a unique immutable sign-in identifier for every user.
Explanation
Correct Answer
A:UPN is an Entra user sign-in identifier and may differ from a human-readable display name. Display names can repeat or change. This matters here because an identity admin needs to avoid confusion between a person's display name and sign-in name when troubleshooting an….
Incorrect Answers
B:Guest restrictions govern how much directory information external identities can discover. App permissions and B2B authentication are separate controls. This matters here because an identity admin needs to avoid confusion between a person's display name and sign-in name when troubleshooting an….
C:Applications and automation can authenticate as workload principals with scoped authorization, rather than borrowing a person's account. This matters here because an identity admin needs to avoid confusion between a person's display name and sign-in name when troubleshooting an….
D:Display names are neither guaranteed unique nor the standard user sign-in identifier. Inspect the userPrincipalName and immutable object ID for the relevant troubleshooting purpose.
Question 609
An Azure subscription Owner cannot edit an Entra user's authentication methods. What is the cause?
- Assign Owner at the smallest authorized Azure scope.
- Review the applicable Azure Files data-plane or share-level authorization model.
- Verify separately delegated Entra identity permissions rather than assuming subscription ownership grants them.
- Resolve the user's Entra principal object ID and tenant before creating the RBAC assignment.
Explanation
Correct Answer
C:Azure resource Owner does not automatically provide directory administrative authority. Identity-plane access is a separately controlled entitlement.
Incorrect Answers
A:Owner includes ordinary resource management and role-assignment control. Its broad reach warrants tight scope and governance. This matters here because an Azure subscription Owner cannot edit an Entra user's authentication methods. What is the cause.
B:Azure Files content permissions require suitable share authorization and possibly file ACLs depending on the identity model. Control-plane Reader is insufficient. This matters here because an Azure subscription Owner cannot edit an Entra user's authentication methods. What is the cause.
D:Email aliases and display names may change or collide. The resolved principal ID is the stable assignment target. This matters here because an Azure subscription Owner cannot edit an Entra user's authentication methods. What is the cause.
Question 610
A resource group role is inherited by a managed disk created later. What behavior of Azure's hierarchy accounts for this?
- Assume a Reader grant on an unrelated sibling resource group automatically applies to the new managed disk.
- Set the custom role's assignableScopes to the allowed subscription or ancestor scope.
- Apply the role at an ancestor scope so its allowed actions flow to descendants.
- Remove unnecessary delete Actions from the custom role definition and reassess effective assignments.
Explanation
Correct Answer
C:A role assignment at a resource group covers existing and newly created child resources where the role applies. Inheritance does not require per-resource duplication. This matters here because a resource group role is inherited by a managed disk created later. What behavior of Azure's hierarchy accounts for this.
Incorrect Answers
A:A grant on one resource group does not flow sideways to a sibling group. The disk inherits permissions only from its own ancestor scopes or grants applied directly.
B:Assignable scopes constrain where a custom role definition can be assigned. They are distinct from the actual scope of each individual assignment. This matters here because a resource group role is inherited by a managed disk created later. What behavior of Azure's hierarchy accounts for this.
D:Least privilege requires granting only the provider operations the workload needs. Removing delete from one role still requires checking other positive grants. This matters here because a resource group role is inherited by a managed disk created later. What behavior of Azure's hierarchy accounts for this.
