Microsoft AZ-104 - Microsoft Azure Administrator - Manage Azure Identities and Governance -Manage access to Azure Resources - Review

1. An administrator must create, update, and delete resources in a resource group. A separate team manages role assignments. Which built-in role should the administrator receive?

A. Reader

B. Contributor

C. User Access Administrator

D. Owner

2. A backup application must read, write, and delete blobs in one container. Which role grants the required access when assigned at the container scope?

A. Reader

B. Storage Blob Data Reader

C. Storage Account Contributor

D. Storage Blob Data Contributor

3. An application team needs to manage every resource in App-RG, including resources added later. What is the narrowest scope that covers this requirement?

A. App-RG resource group

B. One existing resource in App-RG

C. The subscription containing App-RG

D. The management group containing the subscription

4. An auditor receives Reader at the Production management group. The Prod-East and Prod-West subscriptions are descendants of that group. The Dev subscription belongs to a separate branch. Where does this assignment grant Reader?

A. Only on the Production management group itself

B. On all three subscriptions

C. On Prod-East, Prod-West, and their descendant resources

D. Only on the two subscription objects, without access to their resources

5. Maya has Reader directly on a subscription. She also belongs to a group that has Contributor on App-RG in that subscription. What can Maya do if no other assignments or denies apply?

A. View resources throughout the subscription and manage resources in App-RG

B. Manage resources throughout the subscription

C. View resources throughout the subscription with Reader permissions only

D. Manage resources in App-RG and have no access elsewhere in the subscription

6. A user has Contributor on a resource group. An applicable deny assignment blocks deletion of VM01. What happens when the user tries to delete VM01?

A. The deletion succeeds because Contributor includes delete permissions.

B. The deletion succeeds if Contributor was assigned directly to the user.

C. The deletion is blocked because the deny assignment applies to that action.

D. The deletion is blocked, and the user loses all Contributor permissions on the resource group.

7. An operator receives an authorization error when restarting VM01. Which portal action best shows whether the operator has a direct, group-based, or inherited role assignment that applies to the VM?

A. Open the VM’s Activity log and look for successful restarts.

B. Open the VM’s Access control (IAM) blade and select Check access.

C. Open the subscription’s Azure Policy compliance view.

D. Open the operator’s Microsoft Entra sign-in logs.

8. A Contributor tries to deploy a VM and receives RequestDisallowedByPolicy. The error names a policy that limits allowed regions. What should the administrator investigate first?

A. Whether the user needs Owner on the subscription

B. Whether the user’s Contributor assignment has propagated

C. Whether the user needs a new Conditional Access policy

D. Whether the requested region is allowed by the policy named in the error

9. An administrator just assigned Virtual Machine Contributor at the correct scope. The user retries immediately in an existing portal session and still receives an authorization error. No applicable deny assignment exists. What is the best next step?

A. Allow time for propagation, refresh the session by signing out and back in, and retry.

B. Replace the resource-level assignment with subscription-level Contributor.

C. Add Reader at the same scope to enable VM management.

D. Change the assignment from a user assignment to a group assignment.

10. An engineer has an eligible PIM assignment for Virtual Machine Contributor on Prod-VMs. The engineer needs to use the role during a maintenance window. What should the engineer do?

A. Ask for a permanent active assignment before starting work.

B. Wait for the eligible assignment to become active automatically.

C. Request activation and satisfy the configured requirements, such as MFA or approval.

D. Complete an access review to convert the assignment to active.

11. A project team wants new members to make one request for access to a security group, an enterprise app, and a SharePoint site. A project owner must approve the request, and access should expire after 90 days. Which feature fits?

A. An access review

B. An access package in entitlement management

C. A Conditional Access policy

D. A PIM role activation policy

12. Every quarter, a project owner must verify that current members still need their project access package. Assignments denied during the review should be removed when the results are applied. Which feature fits?

A. A Conditional Access sign-in frequency control

B. A PIM activation approval

C. An access package request approval

D. A recurring access review of the access package assignments

13. An app on a single Azure VM must read blobs without storing credentials. Its identity should be deleted automatically when the VM is deleted. What should you configure?

A. A system-assigned managed identity with Storage Blob Data Reader on the target container

B. A user-assigned managed identity with Storage Blob Data Reader on the target container

C. A system-assigned managed identity with Reader on the storage account

D. A user-assigned managed identity with Reader on the storage account

14. Two Azure VMs need to share the same identity and permissions. The identity must remain available when either VM is replaced. Which configuration meets the requirement?

A. Enable a system-assigned managed identity on each VM.

B. Attach one VM’s system-assigned managed identity to the other VM.

C. Attach the same user-assigned managed identity to both VMs.

D. Create a separate user-assigned managed identity for each VM.

15. Employees already have the correct Azure RBAC roles. The organization also wants to require MFA and a compliant device when they access the Azure portal. Which feature enforces those requirements?

A. Azure Policy

B. Microsoft Entra Conditional Access

C. Azure RBAC

D. Microsoft Entra access reviews

Answer key and explanations

#	Correct answer	Explanation
1	B — Contributor	Contributor grants resource management permissions at the assigned scope. Owner would also allow the administrator to assign Azure roles.
2	D — Storage Blob Data Contributor	This role grants read, write, and delete access to blob data. Storage Blob Data Reader covers reads, while Storage Account Contributor manages the storage account itself.
3	A — App-RG resource group	An assignment at the resource group applies to its current and future resources. A single-resource assignment is too narrow, and a subscription assignment reaches other resource groups.
4	C — Both production subscriptions and their descendants	Azure RBAC permissions inherit down the selected management group’s branch. The separate Dev branch is outside the assignment scope.
5	A — View throughout the subscription and manage within App-RG	Role grants are additive. The subscription assignment supplies Reader across the subscription, and the group assignment adds Contributor within App-RG.
6	C — The applicable deny blocks deletion	A deny assignment overrides a role grant for the action it covers. Other Contributor permissions remain available unless separately blocked.
7	B — Check access on the VM	Starting at the target resource lets you inspect the role assignments that apply there and trace their source. Then compare the roles’ permissions with the restart action.
8	D — Check the policy’s allowed regions	RequestDisallowedByPolicy identifies a governance restriction. A user can have RBAC permission to deploy a VM and still have the deployment blocked by Azure Policy.
9	A — Allow propagation and refresh the session	Recent role assignments can take time to become effective. Refreshing the session after allowing for propagation tests the intended assignment without expanding access.
10	C — Request PIM activation and meet the requirements	Eligibility lets the engineer request activation. The role grants usable permissions during the activation window once the configured requirements are satisfied.
11	B — Access package	An access package bundles resources into one assignment. Its policy can control who can request access, who approves it, and when it expires.
12	D — Recurring access review	An access review checks whether existing assignments are still needed. Applying the results removes assignments that were denied.
13	A — System-assigned identity with Storage Blob Data Reader	The identity shares the VM’s lifecycle. The separate data role authorizes blob reads within the container.
14	C — One shared user-assigned managed identity	A user-assigned identity is a separate Azure resource that both VMs can use. It survives the deletion or replacement of either VM.
15	B — Microsoft Entra Conditional Access	Conditional Access enforces sign-in and access requirements such as MFA and device compliance. Azure RBAC governs the actions users can perform on Azure resources.