Microsoft AZ-104 Practice Test 72
Question 710
A cross-subscription governance team should read resources from every subscription under a management group. Which scope reduces duplicate grants?
- Assign Reader to one resource group in each subscription and expect all other resource groups to inherit it.
- Assign VM Contributor in each subscription instead of one suitably scoped management-group Reader grant.
- Apply the role at an ancestor scope so its allowed actions flow to descendants.
- Assign Reader at the appropriate management-group scope.
Explanation
Correct Answer
D:Roles granted on a management-group ancestor can be inherited by descendant subscriptions and resources. This is broader than a single resource-group grant. This matters here because a cross-subscription governance team should read resources from every subscription under a management group. Which….
Incorrect Answers
A:Resource-group grants do not flow sideways to sibling groups. A management-group or subscription-level Reader assignment provides inherited visibility across the needed descendants.
B:VM Contributor allows operational changes and is broader than cross-subscription read-only governance. Assign Reader at the relevant management group for inherited resource visibility.
C:A role assignment at a resource group covers existing and newly created child resources where the role applies. Inheritance does not require per-resource duplication. This matters here because a cross-subscription governance team should read resources from every subscription under a management group. Which….
Question 711
A newly moved subscription unexpectedly inherits a Reader grant from its new management group. Where should the grant be traced?
- Inspect virtual-machine Compute Actions instead of parent-scope role assignments to explain an inherited Reader grant.
- Search only for a direct subscription-level Reader role and ignore inherited grants on the new management-group ancestor.
- Inspect only the VM's resource-group grants and ignore the new management group's inherited Reader assignment.
- Inspect role assignments at the management group and applicable parent hierarchy.
Explanation
Correct Answer
D:A subscription's location in the management group tree determines its ancestor role assignments. A move can change effective inherited permissions. This matters here because a newly moved subscription unexpectedly inherits a Reader grant from its new management group.
Incorrect Answers
A:Compute role-definition actions describe permitted operations, not where a role was assigned. Trace the Reader assignment through the new management-group ancestry and subscription.
B:Management-group role assignments flow to descendant subscriptions. Inspect the new parent hierarchy and effective Reader grants rather than expecting a local assignment.
C:Moving a subscription under a new management group changes its ancestor permissions. Review effective assignments at management-group and subscription scopes.
Question 712
A principal can view and start VMs but must not manage role assignments. Which permission distinction is essential?
- Give the principal Owner merely to permit VM starts, despite Owner also allowing role assignment changes.
- Use resource-management roles without Microsoft.Authorization/roleAssignments/write.
- Delegate separate RBAC assignment administration only if approved, using a suitable scoped access role.
- Grant User Access Administrator just to allow VM start operations, then leave role-assignment management unrestricted.
Explanation
Correct Answer
B:Operational compute control and access delegation are different Azure management actions. A role that lacks assignment write cannot grant roles solely because it can start a VM. This matters here because a principal can view and start VMs but must not manage role assignments. Which permission distinction is essential.
Incorrect Answers
A:Owner grants broader delegation and resource management than this principal needs. A narrower VM-operational role with no roleAssignments/write is consistent with the stated separation.
C:Resource modification rights do not imply authority to grant permissions. Role Based Access Control Administrator or User Access Administrator covers assignment tasks under appropriate conditions. This matters here because a principal can view and start VMs but must not manage role assignments. Which permission distinction is essential.
D:The access-admin role enables permission delegation rather than VM lifecycle actions. VM start requires the appropriate Compute permission while role-assignment writes remain excluded.
Question 713
A Contributor can deploy a VM but gets denied when creating an RBAC assignment within the same group. What should an admin avoid doing?
- Do not treat resource Contributor as an RBAC delegation role; grant narrowly scoped assignment authority if justified.
- Grant Contributor a broader subscription scope and expect that to include Azure RBAC role-assignment write rights.
- Delegate separate RBAC assignment administration only if approved, using a suitable scoped access role.
- Resolve the user's Entra principal object ID and tenant before creating the RBAC assignment.
Explanation
Correct Answer
A:Resource deployment writes do not include authorization writes. Promoting to Owner broadly would exceed the narrow access need when a dedicated role is sufficient. This matters here because a Contributor can deploy a VM but gets denied when creating an RBAC assignment within the same group.
Incorrect Answers
B:Contributor lacks role-assignment delegation permissions by default at any scope. Use a scoped role with authorization grant rights, rather than broadening Contributor and hoping the missing operation appears.
C:Resource modification rights do not imply authority to grant permissions. Role Based Access Control Administrator or User Access Administrator covers assignment tasks under appropriate conditions. This matters here because a Contributor can deploy a VM but gets denied when creating an RBAC assignment within the same group.
D:Email aliases and display names may change or collide. The resolved principal ID is the stable assignment target. This matters here because a Contributor can deploy a VM but gets denied when creating an RBAC assignment within the same group.
Question 714
A workload must read data from one Azure file share but currently holds only management Reader. What permission category should be examined?
- Assign Storage Blob Data Reader at the target container scope.
- Confirm Key Vault's RBAC permission model and the user's secret data-plane role.
- Assign only Azure resource-management Reader and expect it to authorize SMB file contents in a private share.
- Review the applicable Azure Files data-plane or share-level authorization model.
Explanation
Correct Answer
D:Azure Files content permissions require suitable share authorization and possibly file ACLs depending on the identity model. Control-plane Reader is insufficient. This matters here because a workload must read data from one Azure file share but currently holds only management Reader. What permission….
Incorrect Answers
A:Blob contents require storage data-plane DataActions. Management-plane Reader of the storage account does not itself grant ordinary blob contents access. This matters here because a workload must read data from one Azure file share but currently holds only management Reader. What permission….
B:The resource-management plane and vault secret data operations are distinct. A vault may require Key Vault Secrets User or another specifically authorized data-plane role. This matters here because a workload must read data from one Azure file share but currently holds only management Reader. What permission….
C:ARM Reader cannot replace the supported Azure Files share-level and file permissions. Review the correct file data authorization model.
Question 715
An SMB user can mount a share but cannot open a directory. Which independent authorization level should be checked?
- Add VM-management actions to Azure RBAC instead of checking SMB share permissions and file-system ACLs.
- Add an Azure management-plane role assignment without checking share-level and NTFS access to the target directory.
- Inspect file and directory ACLs in addition to the share-level role.
- Compare the assignment principal ID against directory deleted objects and surviving service principals.
Explanation
Correct Answer
C:Azure Files SMB access may involve both share-level RBAC and filesystem ACLs. One successful authorization step does not eliminate the other. This matters here because an SMB user can mount a share but cannot open a directory. Which independent authorization level should be checked.
Incorrect Answers
A:Azure VM management rights do not authorize reading folders over SMB. Both share-level authorization and NTFS/file-system permissions must allow the requested directory access.
B:SMB mounting and opening a directory can be governed by different share- and file-level permissions. Inspect Azure Files share RBAC and NTFS ACLs for that identity, not unrelated resource-group access.
D:RBAC references can outlive removal of the directory object. Reusing the deleted user's friendly name is not reliable evidence of its identity. This matters here because an SMB user can mount a share but cannot open a directory. Which independent authorization level should be checked.
Question 716
The compliance dashboard lists a resource as exempt rather than compliant. What explains that status?
- Delete an unrelated management lock so the Azure Policy Exempt state will automatically change to Compliant.
- Inspect the relevant Policy exemption and its category, scope and expiry.
- Inspect the initiative definition and individual policy reference IDs.
- Treat the Exempt compliance state as equivalent to policy compliance and ignore the waiver's supporting reason.
Explanation
Correct Answer
B:Exempt resources may be excluded from ordinary compliance processing under an approved exception. An exemption is not proof the resource's underlying configuration satisfies the rule. This matters here because the compliance dashboard lists a resource as exempt rather than compliant. What explains that status.
Incorrect Answers
A:Management locks guard ARM changes and are independent of policy exemption evaluation. A resource marked Exempt reflects an approved scoped waiver whose details, category and expiration must be inspected.
C:An initiative aggregates multiple definitions under one assignment. Individual policy references retain distinct evaluation results. This matters here because the compliance dashboard lists a resource as exempt rather than compliant. What explains that status.
D:An exempt resource is excluded by an explicit exemption, not necessarily compliant with the underlying rule. Review its category, scope and expiry.
Question 717
A support engineer needs to know whether a quota increase is relevant for a failed VM deployment. Where should limits be examined?
- Scope and time-limit an approved Azure Policy exemption for only the exceptional resource.
- Check quota limits and access assignments in the destination subscription.
- Inspect the applicable Azure Policy tag-value allowlist and deny evaluation result.
- Check subscription-level compute vCPU quotas for the applicable region and VM family.
Explanation
Correct Answer
D:Quota is evaluated per subscription and relevant region/family. A storage account capacity metric cannot establish available VM family quota. This matters here because a support engineer needs to know whether a quota increase is relevant for a failed VM deployment.
Incorrect Answers
A:Governance deviations should be precise, justified and auditable. Removing the parent policy assignment for a single emergency would weaken all children. This matters here because a support engineer needs to know whether a quota increase is relevant for a failed VM deployment.
B:Subscription moves can change available quotas and effective administrative scopes. The destination does not automatically inherit all operational limits of the source subscription. This matters here because a support engineer needs to know whether a quota increase is relevant for a failed VM deployment.
C:The failed tag value violates an enforced resource governance condition. The creator's Azure Contributor permission cannot override it. This matters here because a support engineer needs to know whether a quota increase is relevant for a failed VM deployment.
Question 718
A deployment fails with quota exceeded despite other regions having capacity. What should the administrator request?
- Allow the resource group's metadata region to differ from its individual resources' regions.
- Use Azure Policy tag inheritance or modification because resource tags do not automatically inherit.
- Inspect policy evaluation details and the allowedLocations parameter in the effective assignment.
- Request an eligible quota increase in the deployment region and VM family or select a permitted alternative.
Explanation
Correct Answer
D:Regional quota cannot be borrowed from a separate region. A request must target the limiting resource family and scope.
Incorrect Answers
A:A resource group's chosen location stores its metadata. Supported contained resources may be deployed to other locations, subject to policy and service constraints. This matters here because a deployment fails with quota exceeded despite other regions having capacity.
B:Resource group tags do not automatically copy to child resources. An appropriate policy is required to apply or enforce matching metadata. This matters here because a deployment fails with quota exceeded despite other regions having capacity.
C:A deny decision depends on evaluated resource properties and assignment parameters. Changing unrelated tags will not fix a location outside the allowlist. This matters here because a deployment fails with quota exceeded despite other regions having capacity.
Question 719
A large business wants a fixed list of approved VM SKUs enforced for every project. Which governance feature can implement the allowed-values rule?
- Inspect the initiative definition and individual policy reference IDs.
- Build a management-group hierarchy aligned to governance boundaries.
- Assign an Azure Policy deny rule that evaluates the costCenter tag against approved values.
- Assign Azure Policy restricting permitted virtual machine SKUs across the desired scopes.
Explanation
Correct Answer
D:Policies can evaluate requested SKU properties and deny nonapproved sizes. A budget alert detects cost but cannot reliably block an invalid SKU. This matters here because a large business wants a fixed list of approved VM SKUs enforced for every project. Which governance feature can….
Incorrect Answers
A:An initiative aggregates multiple definitions under one assignment. Individual policy references retain distinct evaluation results. This matters here because a large business wants a fixed list of approved VM SKUs enforced for every project. Which governance feature can….
B:Management groups support broad governance scope and administrative inheritance. Naming individual subscription resources is not an effective hierarchy. This matters here because a large business wants a fixed list of approved VM SKUs enforced for every project. Which governance feature can….
C:Deny can prevent unauthorized tag values in management requests. A free-form operational convention cannot enforce an allowlist. This matters here because a large business wants a fixed list of approved VM SKUs enforced for every project. Which governance feature can….
Question 720
A valid SKU is rejected because its allowed-size policy parameter is stale. Where should the correction be made?
- Assign an Azure Policy deny rule that evaluates the costCenter tag against approved values.
- Inspect policy evaluation details and the allowedLocations parameter in the effective assignment.
- Review and update the approved SKU parameter in the effective Azure Policy assignment under change control.
- Create an unrestricted SKU waiver for all resources instead of correcting the outdated allowed-SKU assignment parameter.
Explanation
Correct Answer
C:Policy parameters determine the allowed set. VM Owner cannot override a deny rule by resubmitting the same noncompliant SKU. This matters here because a valid SKU is rejected because its allowed-size policy parameter is stale.
Incorrect Answers
A:Deny can prevent unauthorized tag values in management requests. A free-form operational convention cannot enforce an allowlist. This matters here because a valid SKU is rejected because its allowed-size policy parameter is stale.
B:A deny decision depends on evaluated resource properties and assignment parameters. Changing unrelated tags will not fix a location outside the allowlist. This matters here because a valid SKU is rejected because its allowed-size policy parameter is stale.
D:A broad exception bypasses the size restriction. Update the governed policy parameter to the actually approved SKU values and reevaluate.
