Microsoft AZ-104 Exam Dumps, Practice Test Questions

Re-creating an Azure RBAC assignment to the same group does not refresh the engineer’s existing Entra authentication context. The resource-group role is already assigned; the newly added member may still be using older group claims or cached effective access. Ask for a fresh sign-in or token and allow for membership/authorization propagation before making a redundant permission change.

Azure RBAC supports group principals. The reported timing points to membership freshness rather than a fundamental unsupported assignment.

Global Administrator is a separate, far broader directory role and is not required merely to inherit an Azure resource-group Contributor role.

The role would work for reports but extend access to other containers in the account, contradicting the least-privilege boundary. Narrowing the scope to the target container is available.

Resource-group Reader is a management-plane role and does not confer the needed blob DataActions. It would likely permit viewing unrelated account metadata while failing the actual download operation.

Owner gives far more management and delegation rights than a container audit requires. Broad Owner is not equivalent to a narrowly scoped blob data read grant with Entra authentication.

Assignable scopes govern where a custom role definition is eligible for assignment; changing that property alone does not create an assignment for this principal on the VM in rg-test. A second target-VM assignment is still necessary.

Subscription-wide Contributor would cover the VM, but also grant substantial write permissions over unrelated production and test resources. The scope is wider than necessary.

Even a role containing the required start Action has no effect on a VM in a sibling resource group unless the principal receives an assignment at that VM or an appropriate ancestor scope.

An application's client ID identifies the app registration across tenants, but the Azure role assignment must refer to the actual service principal's directory principal/object ID in this tenant. The client ID is not a substitute for that principal reference.

Names are human-readable attributes and do not merge authorization identities. Matching display strings cannot move role assignments from a user object to a service principal.

The application registration and the service principal are different Entra objects. Azure RBAC permissions are assigned to the service principal security principal, so using the app registration's object ID would not correct the mistargeted grant.

A delete lock might block deletion, but it does not grant the missing role-assignment Action. Even with no lock, Contributor cannot normally delegate roles.

The VM write Action manages compute properties, not access delegation. A caller with VM Contributor still lacks the distinct authorization action to create or remove Azure RBAC role assignments at the VM scope.

Reader can inspect VM and IAM metadata but cannot issue Microsoft.Authorization/roleAssignments/write. The request needs a narrowly scoped role assignment administrator, not another read-only grant.

Reader is a grant, not a deny policy. A broad read role does not remove separately assigned write permissions at a narrower resource-group scope.

RBAC combines permitted actions rather than promoting the principal to a new role. Neither Reader nor Contributor alone gives general RBAC delegation authority.

Overlapping grants are a normal feature of Azure RBAC evaluation. They do not invalidate each other merely because their action sets differ.

AssignableScopes identifies where a custom role definition is available; it does not eliminate restrictions on where its permissions may be assigned. Microsoft documents that a custom role containing DataActions cannot be assigned at a management-group scope, even when the management group is in its AssignableScopes. Forcing or retrying the same assignment will not bypass this limitation.

Azure RBAC role Actions generally grant control-plane permissions such as reading storage account management properties; DataActions govern data-plane blob access. Replacing DataActions with a storage account read Action changes the entitlement rather than resolving its assignable-scope problem. The users would be able to inspect management metadata but would not necessarily be authorized to read blob objects as intended.

The Reader role at management-group scope can be inherited for Azure Resource Manager management-plane visibility, but it is not equivalent to a role that grants blob DataActions. The scenario calls for reading blob data across three subscriptions. Assigning management Reader would leave that data-plane need unmet even if its management-group assignment were accepted and inherited successfully.

Private DNS controls name resolution, not authorization to modify a subnet. Linking a zone cannot add missing network-management Actions.

Network attachment does not confer Azure RBAC rights. The identity's VNet actions still depend on its actual role assignments.

Read access to one resource gives no general subscription-write entitlement. Azure authorization does not infer broad resource control from endpoint visibility.

RBAC grants target security principal IDs, not display-name equivalence. Deleting and recreating a managed identity produces a different principal, so the old role assignment does not authorize the new identity and the current principal needs its own grant.

Reader allows control-plane inspection of resources, not the storage data-plane write operation required by the nightly export. The recreated identity needs the correct data role granted to its new principal ID at the storage scope.

Names are not stable security principal identifiers. A matching name cannot resurrect the deleted service principal or transfer its old role assignment.

Direct assignments belong to the subscription scope, not to its former parent. The statement confuses inherited ancestor privileges with explicit child-scope grants.

A hierarchy change does not promote a role's Actions or assigned scope. An existing subscription role does not expand to the entire Entra tenant.

Resource groups do not have to be recreated for an explicit subscription assignment to continue applying. The assignment already targets their subscription ancestor.

Subscription scope inherits across all resource groups in sub-A. It would meet the read function but violate the stated requirement to limit visibility to one account.

Blob Data Owner provides data-plane capabilities for storage objects, not a minimal management Reader grant. It can expose and modify data beyond the requested account-property inspection.

Reader is designed for viewing management resource properties. Contributor adds management writes over the group and exceeds the auditor's requirements.