Microsoft AZ-104 Exam Dumps, Practice Test Questions

That removes the requested identity selection and would broaden access beyond the approved applications.

Network rules can restrict request origins, not establish that the authenticated Entra application principal belongs to the approved identity set. Several identities might share an allowed subnet or NAT address; another authorized application could run elsewhere. The scenario requires a supported attribute-based condition on the data-role assignment itself.

An ordinary unconditioned Azure RBAC data-role grant does not inspect the caller’s display-name prefix on each blob request. A label is also not a secure identity boundary. The required design must apply a supported principal/identity attribute criterion in an Azure role-assignment condition alongside the data action and its scope.

A permanent subscription Owner assignment would grant standing control over unrelated resources and Azure RBAC delegation, well beyond the deployment window. It also gives the automation identity powerful permissions even when no release is scheduled. The requested design must restrict the role to the resources used by the pipeline and give the assignment a fixed end time, not preserve Owner indefinitely.

Reader can inspect ARM resources but cannot create or update them during Bicep deployment. Bicep compiles a deployment request; it does not bypass the deployment principal’s Azure RBAC permissions. Even a narrow Reader assignment leaves the service principal unable to perform the documented resource writes, regardless of the deployment template contents.

Complete deployment mode determines whether resources absent from a template may be deleted. It is not an authorization mechanism or a time-limited elevation feature. A principal without appropriate management Actions still receives access-denied errors, and Complete mode can introduce additional deletion risk. It cannot replace an Azure role assignment with defined duration and scope.

An account key is a powerful shared secret, often able to access much more than one container. Placing it in scripts increases exposure and conflicts with identity-based least privilege.

Managed identity removes a secret, but management-plane Reader does not grant Blob data-plane content access. Scope the appropriate Storage Blob Data role to the target container for the managed identity.

Managed identities have distinct service-principal IDs; data-plane RBAC applied to a different principal does not authorize this VM. Verify the assigned principal ID and the target container scope rather than relying on display names.

Changing a role definition's assignable scopes does not introduce the missing instanceView/read Action. The actual VM API operation must be included in the Actions list and granted through an applicable assignment.

Role-assignment writes grant access-delegation capability, not VM instance-view query permission. This would add sensitive privilege without addressing the specific Compute provider action.

Run Command executes commands in the guest and is a different, more privileged operation than reading instance-view power state. The least-privilege fix is the specific instanceView/read management Action, not an unrelated guest command Action.

AssignableScopes limits where the role definition can be used, not which actions it grants within that scope. A wildcard storage-account Action would still include listKeys; use NotActions for the one management-plane operation to exclude.

NotDataActions subtracts data-plane permissions from the same role, while list-keys is a management Action. It would not target the requested operation.

Listing storage account keys is a management-plane provider Action, not a blob content DataAction. Moving it to a data field would not express the desired role exclusion.

Resource Contributor provides broad configuration changes unrelated to read-only financial reporting. It is not a minimal access solution.

Cost Management Contributor is more privileged than the requested read-only financial visibility: it grants cost-management write operations such as managing budgets or exports at applicable scopes. A Cost Management Reader or appropriate billing-reader role provides cost views without those changes; there is no reason to grant budget administration to a report viewer.

Azure resource-group Reader applies to Azure Resource Manager resources at that scope. It does not grant billing-account invoice or broad Cost Management report access merely because the automation is deployed there. The operator needs the appropriate reader role at the actual cost or billing data scope, not Reader on the unrelated automation's resource group.

NotActions subtracts control-plane provider operations from Actions, not blob data-plane operations from DataActions. Placing a blob deletion permission there would not perform the requested exclusion of the wildcard data grant, so the role could retain a deletion pathway.

AssignableScopes specifies where a role definition may be used. Removing a subscription changes assignment eligibility and may disrupt the role entirely; it does not selectively remove the blob-delete action while preserving read and write for already intended workloads.

An Audit policy evaluates and reports compliance but is not an RBAC deny-assignment mechanism. Creating it cannot subtract a data operation from the team’s custom role. The permission definition itself must be adjusted and effective assignments checked.

Limiting only the role definition ensures the delegated operator cannot grant Owner, but it still allows assigning Reader to users, security groups, and service principals. That violates the explicit target-principal-type constraint. A delegation condition must test the request principal type as well as the allowed role when recipients are restricted by category.

Principal ID addresses one particular recipient object, not a category of eligible recipients. The helper’s own object ID describes the delegate rather than the target service principals, and cannot match unknown new app identities. A request principal-type attribute is the appropriate selector for all service principals without enumerating IDs.

Azure resource tags describe the resources, not the Microsoft Entra principal type in a new role-assignment request. A tagged VM does not enforce whether a delegation helper grants Reader to a user versus a service principal. The condition must evaluate Azure authorization request attributes rather than depend on ordinary resource metadata.

Owner enables resource changes and RBAC delegation well beyond the job's read use case. Broad privilege is not an acceptable shortcut for a monitoring principal.

Contributor can modify settings that the monitoring job must not change. Query-focused read permissions and limited scope should be included instead of granting broad administration.

A broad wildcard can include workspace updates and deletions, violating the stated read-only constraint. The needed query operations should be specified narrowly.

The registration definition is an authorization offer stored in the customer subscription; making an identical definition in the provider tenant does not attach the customer resource group to that authorization. This option confuses the identity of the managing tenant with the location of the delegated resource definitions. The missing element is a customer-scope registration assignment referencing the existing definition, not a second offer.

Storage Blob Data Reader is an Azure Storage data-plane permission and neither creates nor activates Microsoft.ManagedServices registration assignments. It also would not delegate Azure Resource Manager management of arbitrary resources in the customer resource group. The provider already has an authorized role list in its Lighthouse definition; the specific missing prerequisite is an assignment connecting that definition to the customer resource-group scope.

Manually inviting every provider engineer as a B2B guest and granting subscription Contributor circumvents the limited delegated access arrangement in the stem. It enlarges the management scope beyond the approved resource group, adds separate guest lifecycle administration, and still does not repair the Lighthouse onboarding resource relationship. Use the existing registration definition with a matching registration assignment for the customer-approved resource group.

Audit marks a matching deployment as noncompliant but does not reject the incoming resource request. It is valuable for observation, not for the preventive region requirement.

Disabled turns off policy evaluation for the rule, so a request in an unapproved region proceeds without enforcement from that definition.

AuditIfNotExists checks related-resource existence and records compliance findings. It is not the effect for rejecting an otherwise valid resource whose region is disallowed.