Microsoft AZ-104 - Microsoft Azure Administrator - Manage Azure Identities and Governance - Manage Azure Subscriptions and Governance - Review

AZ-104 Review Quiz — Manage Azure Subscriptions and Governance

1. Your organization wants to identify resources deployed outside approved Azure regions without blocking deployments. Which Azure Policy effect should you use?

A. Deny

B. Modify

C. Audit

D. DeployIfNotExists

2. You need to assign several policy definitions together as a single governance package. What should you create?

A. An initiative

B. A management lock

C. A resource group

D. A custom Azure role

3. A new policy blocks deployment of a critical application. An approved exception must apply only to that application’s resource group for 30 days. What should you configure?

A. Disable enforcement for the entire policy assignment.

B. Remove the subscription from its management group.

C. Give the application team Owner permissions.

D. Create a policy exemption with an expiration date.

4. A DeployIfNotExists policy identifies existing VMs that lack the required backup configuration. What should you use to deploy the missing configuration?

A. A new Reader assignment for the VM owners

B. A remediation task using the policy assignment’s managed identity

C. A ReadOnly lock on each VM

D. A policy exemption for each VM

5. Teams must manage policy assignments at a management group but must be prevented from changing policy definitions. Which approach best satisfies least privilege?

A. Assign Owner at the management group.

B. Assign Resource Policy Contributor at the management group.

C. Create a custom role with the required assignment operations and definition-read permissions.

D. Assign Management Group Reader at the management group.

6. You need to prevent accidental deletion of production resources while allowing authorized configuration updates. Which lock should you apply?

A. CanNotDelete

B. ReadOnly

C. Audit

D. Deny

7. A ReadOnly lock is applied to a resource group containing a VM. A user with Contributor tries to restart the VM. What happens?

A. The restart succeeds because Contributor overrides locks.

B. The restart succeeds because restarting changes no configuration.

C. The restart succeeds if the user starts it through PowerShell

.D. The restart is blocked because the operation requires a control-plane action restricted by the lock.

8. A storage account has a CanNotDelete lock. A user with sufficient data permissions deletes a blob through the Blob Storage data endpoint. What is the expected result, assuming no other protection blocks deletion?

A. The blob deletion is blocked by the account lock.

B. The blob deletion succeeds because it is a data-plane operation.

C. The blob deletion removes the storage account lock.

D. The blob deletion succeeds only if the user is Owner.

9. At which scope can you directly apply an Azure resource lock?

A. Microsoft Entra tenant

B. Management group

C. Subscription

D. Billing account

10. You apply Department = Finance to a resource group. What happens to the resources already inside the group?

A. Their resource tags remain unchanged unless tags are explicitly applied or copied by policy or automation.

B. They automatically receive the tag during the next RBAC evaluation.

C. They receive the tag only if they are VMs.

D. Their existing Department values are immediately replaced.

11. You want supported resources to receive a CostCenter tag from their resource group when the tag is missing. Which approach is most appropriate?

A. Assign Reader to the resource group.

B. Configure a monthly budget.

C. Apply a CanNotDelete lock.

D. Assign a Modify policy and remediate existing noncompliant resources.

12. Which statement about Azure tag case sensitivity is correct?

A. Both tag names and values are case-insensitive.

B. Tag names are case-insensitive for operations, while values are case-sensitive.

C. Tag names are case-sensitive, while values are case-insensitive.

D. Both tag names and values are always case-sensitive.

13. An application and its database are deployed, updated, and retired together. Where should you generally place them?

A. In separate subscriptions for each deployment

B. Directly inside a management group

C. In the same resource group

D. In separate tenants

14. What does the location selected when creating a resource group primarily determine?

A. Where the resource group’s metadata is stored

B. The mandatory region for every resource in the group

C. The region of the subscription’s billing account

D. The only region from which administrators can manage the group

15. You move a supported resource from RG1 to RG2 in the same subscription. Which statement is correct?

A. The resource automatically relocates to RG2’s region.

B. Its resource ID and inherited permissions always remain unchanged.

C. Azure creates a duplicate and keeps the original in RG1.

D. Its resource ID changes, its region stays the same, and its inherited governance must be reviewed.

16. Which statement correctly describes the relationship between Azure subscriptions and Microsoft Entra tenants?

A. A subscription must trust at least two tenants.

B. A subscription trusts one tenant, and a tenant can support multiple subscriptions.

C. Each tenant can support only one subscription.

D. A subscription’s trusted tenant is determined by its resource group locations.

17. A monthly budget reaches its configured 100% actual-cost threshold. What does the budget do by itself?

A. Deallocate every VM in the subscription.

B. Disable the subscription.

C. Send the configured notification without automatically imposing a spending cap.

D. Create a policy that denies new resources.

18. A team wants to stop unnecessary VM compute usage charges outside working hours. Which state should its automation ensure?

A. Stopped (deallocated)

B. Stopped (allocated)

C. Running with no signed-in users

D. Running with an idle CPU

19. You want notifications when Azure Advisor generates new cost recommendations and want to trigger an approved automation workflow. What should you configure?

A. A ReadOnly subscription lock

B. A tag inheritance policy

C. A budget without notifications

D. An Advisor alert connected to an action group

20. Two production subscriptions are under the same management group. You assign an approved-regions policy at that management group and later add a third subscription beneath it. What happens?

A. The third subscription requires an identical direct assignment.

B. The third subscription inherits the assignment, although compliance evaluation and remediation can take time.

C. Only resource groups created before the move inherit the assignment.

D. The third subscription inherits the policy only after its billing ownership changes.

Answer key and explanations

#	Correct answer	Explanation
1	C — Audit	Audit reports noncompliance while allowing the request. Deny is appropriate when the requirement is to block noncompliant deployments.
2	A — An initiative	An initiative groups policy definitions so they can be assigned and tracked together. Each definition retains its individual rule and effect.
3	D — A time-limited policy exemption	An exemption provides a documented exception at the selected scope. An expiration date limits its duration while enforcement continues elsewhere.
4	B — A remediation task	Existing noncompliant resources require remediation to deploy the missing configuration. The assignment’s managed identity must have the permissions needed by the deployment template.
5	C — A custom role	A custom role can grant assignment management while allowing only reads of definitions. Resource Policy Contributor also permits definition management, making it broader than required.
6	A — CanNotDelete	This lock blocks deletion while permitting authorized reads and updates. ReadOnly additionally blocks updates and certain management actions.
7	D — Restart is blocked	A VM restart uses a control-plane POST operation that ReadOnly restricts. The inherited lock applies even when the caller has Contributor or Owner.
8	B — Blob deletion succeeds	Resource locks restrict control-plane operations. Blob deletion through the data endpoint depends on data permissions and protections such as immutability or soft delete.
9	C — Subscription	Locks can be applied to subscriptions, resource groups, and individual resources. Management groups and billing accounts are outside the supported lock scopes.
10	A — Resource tags remain unchanged	Resource tags do not automatically inherit from resource groups or subscriptions. Policy or automation can copy the values when required.
11	D — Modify policy with remediation	Modify can add the missing tag during applicable resource requests. A remediation task can apply the change to existing noncompliant resources.
12	B — Names are case-insensitive, values are case-sensitive	Operations treat Department and department as the same key. Values such as Production and production differ, so consistent spelling matters.
13	C — The same resource group	Resources sharing a lifecycle generally belong together. This supports coordinated management and deletion when the application is retired.
14	A — Metadata location	A resource group’s location determines where its metadata is stored. Resources in that group can be deployed in different Azure regions.
15	D — ID changes, region remains, governance needs review	The resource ID includes its resource group. Moving it changes that ID and changes the parent scope supplying inherited permissions, policies, and locks.
16	B — One tenant per subscription, multiple subscriptions per tenant	The subscription trusts a tenant for identities. Several subscriptions can use the same tenant while maintaining separate resource and governance scopes.
17	C — Send the configured notification	Budgets track spending and trigger notifications. An action group can invoke separately configured automation, but the budget itself does not enforce a hard spending cap.
18	A — Stopped (deallocated)	Deallocation releases the VM’s host allocation and stops VM compute usage charges. Associated disks, networking, and existing financial commitments can still incur charges.
19	D — Advisor alert with an action group	Advisor alerts can notify teams and invoke action groups. A separately configured workflow handles approval, maintenance scheduling, and execution.
20	B — Automatic inheritance with evaluation time	Management group assignments apply down the hierarchy. Adding a subscription brings it into scope, but immediate compliance is not guaranteed because evaluation and remediation take time.