100% Latest & Updated Microsoft AZ-104 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 100
A storage account belongs to resource group `rg-data`, which itself is in subscription `sub-A`. The operations team needs an auditor to read properties of that account but not all other resources in the same group. Which scope most closely meets that requirement?
- Assign Reader at the storage account's resource ID
- Assign Reader on sub-A to avoid looking up a full resource ID
- Assign Storage Blob Data Owner at the same resource-group scope
- Assign Contributor on rg-data because Reader cannot view resource properties
Explanation
Correct Answer
A:The resource-level scope limits the user's management-plane read grant to that account and its applicable descendants. A group or subscription assignment would expose unnecessary resource metadata elsewhere.
Incorrect Answers
B:Subscription scope inherits across all resource groups in sub-A. It would meet the read function but violate the stated requirement to limit visibility to one account.
C:Blob Data Owner provides data-plane capabilities for storage objects, not a minimal management Reader grant. It can expose and modify data beyond the requested account-property inspection.
D:Reader is designed for viewing management resource properties. Contributor adds management writes over the group and exceeds the auditor's requirements.
Question 101
An identity has Reader on the root management group and has a separate Storage Blob Data Reader assignment directly on one blob container. They try downloading a blob in a different container. Why should the request still fail?
- Container names must be alphabetically earlier than the assigned one to inherit data rights
- The blob Data Reader grant is limited to its assigned container, and root Reader adds no blob data rights
- Root Reader implicitly converts every scoped data role into a tenant-wide data grant
- All blob downloads require subscription Owner, even with a container data role
Explanation
Correct Answer
B:Effective permissions combine grants only when each role's action and scope apply to the target. The broad management Reader cannot supply a missing data-plane permission for the sibling container.
Incorrect Answers
A:Azure RBAC uses scope hierarchy, not lexical ordering of resource names. Container naming cannot make sibling objects descendants of each other.
C:Management hierarchy does not expand the scope of a separate data-role assignment. Container-level data permission remains confined to that container.
D:Appropriate blob data roles can authorize downloads without Owner. The failure is that the target blob is outside the actual data-role scope.
Question 102
Two network security group (NSG) resources are in resource group rg-net, and more NSGs will be added there. A custom RBAC role with the needed NSG management Actions is assignable at rg-net, but the user's only role assignment is scoped to the first NSG. The user must manage both existing and future NSGs in rg-net without permission across the entire subscription. Which role-assignment change best meets the requirement?
- Add rg-net to the custom role's assignableScopes but leave the user's assignment on the original NSG
- Assign the role at the subnet resource and assume associated NSGs inherit management rights from that subnet
- Grant the suitable network-management role at the smallest common ancestor containing both NSGs
- Add Microsoft.Network/networkSecurityGroups/write to the role but keep the user's role assignment at the first NSG
Explanation
Correct Answer
C:A role assigned to one NSG does not flow horizontally to another. An assignment on their shared resource group covers both, while still avoiding subscription-wide network rights.
Incorrect Answers
A:AssignableScopes permits a role definition to be assigned at an eligible scope; it does not widen an existing assignment. The user still lacks the role on the other and future NSGs.
B:An NSG is a separate ARM resource, not a child of the subnet merely because it is associated. A role assignment on a subnet does not cover separate NSGs in rg-net; the shared resource group is the relevant ancestor.
D:The role already has NSG management Actions. Adding more permitted Actions cannot extend an assignment to sibling NSG resources or future NSGs in the containing group.
Question 103
An external support company operates a delegated Azure subscription through Azure Lighthouse. Its engineers can manage selected resources although they do not have native user accounts in the customer's Entra tenant. What is the management model that allows that scoped cross-tenant authorization?
- Create one shared Owner login in the customer's tenant and send it to every provider engineer
- Create only an Azure Lighthouse registration definition, but omit its registration assignment at the delegated customer scope
- Use a storage account SAS to grant Azure subscription resource-management roles
- Use Azure Lighthouse delegated resource management with approved role authorizations for the provider tenant
Explanation
Correct Answer
D:Lighthouse projects selected customer scopes into the managing tenant while preserving customer-controlled delegation. It supports resource operations without each engineer needing a customer-tenant guest identity.
Incorrect Answers
A:Shared privileged credentials remove accountability, expand access, and are not how Lighthouse delegated authorization is intended to operate.
B:Azure Lighthouse authorization requires both a registration definition describing the managing-tenant principals and roles and a registration assignment binding that definition at the customer scope. A definition by itself is not an active delegation, so the provider team would not acquire the reported cross-tenant management access.
C:SAS tokens delegate storage data/service operations, not Azure RBAC management of subscriptions. They cannot substitute for Lighthouse delegation.
Question 104
A recovery operator must be able to see the power state and start one specified Azure VM, but must NOT stop, restart, delete, or reconfigure that VM. The available built-in Virtual Machine Contributor role grants additional operations. Which RBAC design best matches this exact limited permission set?
- Create a custom Azure role granting VM read and Microsoft.Compute/virtualMachines/start/action (with required scoped reads), then assign it to the target VM
- Assign built-in Virtual Machine Contributor at the VM resource scope and assume that limits which VM operations are allowed
- Assign built-in Reader at the VM resource scope and expect it to permit starting the VM
- Assign built-in Contributor at subscription scope with no custom restriction
Explanation
Correct Answer
A:A carefully scoped custom role can include virtual-machine read and start action without granting unrelated compute write, restart, stop, or delete operations. Assigning that role only to the required VM limits both actions and resource scope.
Incorrect Answers
B:Scoping Virtual Machine Contributor to the one VM restricts which resource is affected, but that built-in role still allows many operations on that VM beyond the requested start-only permission.
C:Reader allows inspection of configuration and state but does not grant the Microsoft.Compute/virtualMachines/start/action operation required to start the VM.
D:Subscription Contributor grants broad resource changes across the subscription and includes many unneeded compute operations. It violates both the single-resource and start-only constraints.
Question 105
A team is building a least-privilege custom Azure role. The operator must read blob contents from a particular container but must not list storage-account keys or modify storage resources. Which custom role permission category must cover the blob read operation?
- Only Microsoft.Storage/storageAccounts/read under Actions
- Add `Microsoft.Storage/storageAccounts/listKeys/action` to Actions and use account keys for blob reads instead of a scoped Blob data permission
- A generic wildcard Action for all Azure resource providers
- The appropriate Storage Blob dataAction permission, assigned at the supported container scope
Explanation
Correct Answer
D:Reading blob contents is a storage data-plane operation and uses DataActions in Azure RBAC role definitions. The scope can limit where that data permission is applied.
Incorrect Answers
A:That action permits storage-account management metadata inspection but not automatically blob content reads. The data-plane operation remains unauthorized.
B:Listing account keys can provide broad shared-key data access and violates the least-privilege condition. The request requires Entra-authenticated container-level read permissions through a Blob DataAction, not a management action that exposes account credentials.
C:Broad wildcard control-plane actions expand permissions far beyond the container read objective, and do not substitute for the specific data operation needed.
Question 106
A team needs an Entra service principal to read only blobs tagged Project=Orchid in one storage account, while continuing to use Azure RBAC for blob access. Which refinement best limits the permitted objects?
- Add an applicable Azure role assignment condition that checks the blob index tag
- Create a container-level blanket Storage Blob Data Reader assignment without conditions
- Use storage account network firewall rules to allow only users whose blobs have the Project tag
- Create a stored access policy for a service SAS while requiring Entra-based RBAC
Explanation
Correct Answer
A:Azure ABAC role assignment conditions can narrow supported blob data actions using request or resource attributes, including blob index tags. This makes the Project restriction enforceable during the data request.
Incorrect Answers
B:The unconditional role allows reads across the container rather than just blobs tagged Project=Orchid, so it violates the project boundary.
C:Storage firewall rules evaluate network source rather than individual blob tag attributes; they cannot apply an object-tag authorization condition.
D:A stored SAS policy governs a different signed-token authorization path, not an Azure RBAC condition on the service principal.
Question 107
An administrator creates an Azure custom role intended for two specific subscriptions only. Security policy prohibits this role from being assigned anywhere else in the organization. Which property must be limited in the role definition?
- List both subscription IDs under the role definition’s NotActions array instead of restricting its assignableScopes
- The custom role’s assignableScopes property
- Use the role display name to specify the two permitted subscriptions
- Give the custom role Reader permissions only and allow assignment anywhere
Explanation
Correct Answer
B:AssignableScopes describes where a custom role definition is available for assignments. Restricting it to authorized scopes prevents using that definition beyond the intended subscriptions.
Incorrect Answers
A:NotActions lists excluded Azure resource-provider operations within role permissions, not the subscriptions where the custom role can be assigned. AssignableScopes is the actual definition availability boundary; leaving it broad while changing NotActions does not enforce the two-subscription restriction.
C:The name is descriptive metadata and does not constrain where administrators can use the role. Definition availability is controlled by assignableScopes.
D:A narrowly permissioned role is still assignable outside the designated subscriptions unless the definition limits its assignable scope.
Question 108
A platform engineer must let an operations lead assign only the Virtual Machine Reader role to designated support principals at one resource group. Giving the lead unrestricted Owner or User Access Administrator is unacceptable. Which authorization design most directly constrains the delegation?
- Grant Contributor at the management group so it includes all resource groups
- Grant User Access Administrator at the resource group without a role assignment condition
- Create a custom role containing roleAssignments/write without limiting assignable role types
- Assign an appropriate role-management role at the resource group with a role-assignment condition limiting allowed roles and principals
Explanation
Correct Answer
D:Constrained role-assignment delegation can restrict the roles and principal types or identities the delegate may manage at the chosen scope. It permits the specific support grant without full role-administration freedom.
Incorrect Answers
A:Contributor supports resource management but does not normally confer unrestricted Azure RBAC role-assignment rights; granting it higher in the hierarchy also broadens the resource scope beyond the requirement.
B:Unrestricted User Access Administrator permits broader role grants at that scope and may allow delegation of unintended high-privilege roles. It violates the named role-and-principal constraints.
C:A custom role with role-assignment writes would enable access delegation but, without an effective limiting condition, cannot enforce the requirement to assign only Virtual Machine Reader to named support principals.
Question 109
A custom role definition lists a single subscription in assignableScopes. A newly added operations engineer expects to get the role automatically on every resource in that subscription because the definition names it. What additional configuration is required?
- Create a role assignment for the engineer at the intended resource, group, or subscription scope
- Expand the custom role’s assignableScopes to the subscription’s resource groups without making a principal role assignment
- Add the engineer’s group object ID to the role definition’s Actions list instead of creating a role assignment
- Set the role definition to a broader management group without assigning the principal
Explanation
Correct Answer
A:Assignable scopes control where the custom role definition can be assigned; they do not grant that role to a principal. An actual principal-to-role assignment at an eligible scope provides authorization.
Incorrect Answers
B:Changing assignableScopes adjusts where the custom role definition can be assigned, but does not grant the operations engineer permission. Azure RBAC access requires a specific role assignment linking the principal, the role definition, and an actual target scope.
C:Actions is a list of control-plane operations the custom role permits, not a membership list of people or groups. Adding an Entra object ID there cannot authorize the engineer; a principal-to-role assignment at the intended scope is still required.
D:A wider eligible scope only increases where the role could be assigned; it still gives the engineer no permissions without an assignment.
Question 110
A storage auditor must allow requests only when the caller belongs to an approved set of Entra application identities, rather than broadly to any principal with the data role. The assignment is conditional. Which design dimension must the author investigate?
- Grant the same unrestricted data role to all service principals
- Use a supported Azure role assignment condition based on the request principal attribute or approved identity criteria
- Replace the identity condition with storage firewall subnet rules for the current outbound IPs of approved applications.
- Use an unconditional blob data-role assignment and rely on Entra application display-name prefixes to restrict reads.
Explanation
Correct Answer
B:For supported Blob data actions, Azure ABAC can narrow a role assignment using @Principal custom security attributes assigned to the approved Microsoft Entra service principals. Assign a trusted attribute and write the condition against that attribute at an appropriate resource scope; then the data-role grant does not automatically authorize every app identity. A random display-name prefix, a firewall IP rule or an unsupported direct identity selector is not equivalent.
Incorrect Answers
A:That removes the requested identity selection and would broaden access beyond the approved applications.
C:Network rules can restrict request origins, not establish that the authenticated Entra application principal belongs to the approved identity set. Several identities might share an allowed subnet or NAT address; another authorized application could run elsewhere. The scenario requires a supported attribute-based condition on the data-role assignment itself.
D:An ordinary unconditioned Azure RBAC data-role grant does not inspect the caller’s display-name prefix on each blob request. A label is also not a secure identity boundary. The required design must apply a supported principal/identity attribute criterion in an Azure role-assignment condition alongside the data action and its scope.
Microsoft Azure Administrator (AZ-104) Practice Tests
