Microsoft AZ-104 Exam Dumps, Practice Test Questions

A definition default applies wherever the assignment omits a parameter. Editing the common default would risk changing development behavior too; the production assignment should pass the production-specific list explicitly.

Definition or initiative metadata describes an artifact; it does not supply a particular assignment's allowedSkus parameter value. Production needs its own parameter binding.

A resource-group tag is not automatically bound to an Azure Policy definition parameter. Without an explicit assignment parameter value or a definition that reads that tag, the intended production SKU list is not enforced.

Azure Policy evaluates relevant resource requests, not just the first item of a deployment. Including one compliant resource does not shield subsequent violations.

Azure RBAC authorizes management actions but a deny policy is a separate guardrail. A caller may have permission to create resources yet still be prevented from deploying one that violates policy.

The policy evaluates the account’s secure-transfer-required property, not an unrelated tag asserting compliance. A label cannot make an actual insecure resource request pass a deny condition. The second account must meet the property requirement or receive an authorized policy exclusion outside this proposed deployment.

The audit effect records a resource as noncompliant without rejecting a management-plane delete request. It can help the organization identify resources requiring attention, but it does not provide the denyAction protection needed for a parent resource-group cascade deletion. Reporting after deletion is not the requested prevention mechanism.

Contributor grants specified Azure management operations under RBAC, but role assignments cannot override an applicable Azure Policy denyAction restriction. Assigning broader permissions to the person deleting the group increases exposure without changing the policy cascade rule. The resource group should be protected through the policy definition rather than through elevated caller identity.

The append effect changes specified request fields at creation or update time when a policy condition applies. It does not control how child resources are handled when a resource group is deleted. Even adding another tag does not express the requested resource-group cascade restriction; the denyAction details must explicitly govern that operation.

Policy definitions are governance artifacts rather than workloads whose hosting region determines which resource types get evaluated. The rule conditions must be corrected.

The global location value can describe certain globally scoped resource types, but it is not a substitute for the actual permitted Azure regions for virtual machines. A VM deployed in a regional location would fail an allowed-location list containing only global. Preserve the approved regional values and explicitly account for the applicable globally scoped resource types in the policy conditions.

A resource group’s metadata location can differ from the location of resources deployed inside it. Evaluating only the group can mark a VM compliant when the VM itself is in a disallowed region. The rule needs to evaluate the relevant resource location while accounting for supported globally scoped types.

Default is ordinary enforcement for all matching resources within the assignment scope. The requirement is not to deny requests in the other production groups; without an enrollment-specific mode, a compliant rollout scope still applies to every matching group.

DoNotEnforce evaluates compliance but does not initiate the policy effect on resource create or update. It is appropriate for a pure observation pilot, but it does not selectively turn on enforcement for groups that have elected to participate.

Disabling a policy effect removes its evaluation/enforcement behavior and is not equivalent to targeted enrollment. Management locks prevent certain resource operations for different reasons; they do not establish the policy assignment’s opt-in enforcement state.

Audit evaluates the specified resource against the policy rule and records noncompliance, which is useful when governance wants visibility without blocking work. It does not insert missing properties into the submitted ARM create/update request. The requirement here is an automatic, supported change to the property during the operation, so simply switching to Audit leaves the account configuration unchanged.

The Disabled effect prevents the definition from being evaluated as an active rule, so it cannot add the required property or even enforce a correction. Disabling might be appropriate to retire a rule, but this migration specifically requires automatic normalization during create or update. The team needs an effect that supplies a supported modification operation, not a way to stop evaluating resources.

A resource-group Delete lock protects against deleting governed resources or the containing group, but its control is at the ARM management-operation level. It cannot set an aliased property on a new resource request, and it does not invoke a remediation template. The operator may still create a resource missing the requested attribute, so this is unrelated to the automatic adjustment requirement.

Deny blocks an invalid request but does not wait for asynchronous extension creation or configure the related diagnostic resource. It also violates the requirement to audit rather than reject deployments.

The existenceScope controls the range in which Azure Policy searches for related resources, not the post-deployment time when it evaluates them. Broadening the resource search to a subscription cannot prevent a premature evaluation while the required diagnostic extension is still provisioning. Adjust evaluationDelay for the asynchronous operation.

Removing existenceCondition broadens what counts as an existing related resource but does not configure a delay. It can also cause inaccurate compliance results because the intended property check disappears.

A storage firewall controls which clients or networks can reach a particular storage account; it does not decide which Azure resources are evaluated by a policy assigned at subscription scope. It would neither target all resources located in West Europe nor exclude resources in other regions from governance evaluation. The question concerns an assignment selector, not data-plane network reachability.

Contributor role assignments authorize users or identities to manage Azure resources at a particular RBAC scope. They do not select which resource locations an Azure Policy assignment evaluates, even if the administrators happen to work in West Europe. Changing Contributor would alter management access and leave the subscription-wide policy evaluation problem unsolved; use a policy resource selector instead.

Resource-group location is metadata for that group and does not relocate existing VMs, storage accounts, or networking resources into West Europe. Rewriting group metadata cannot create a reliable Azure Policy geographic rollout boundary and could introduce confusion about actual resource placement. The governed values are the resources’ locations; resource selectors at the policy assignment handle that condition directly.

Disabling the initiative would remove evaluation for the other rules, not selectively change the one deny effect into auditing.

Changing identifiers is not a reliable way to switch a policy effect. It can break references rather than express a controlled per-definition override.

An exemption removes the selected scope from the relevant compliance evaluation; it does not change one policy definition's deny effect into Audit. An assignment override targeting the definition reference is needed to preserve the rest of the initiative.

Recreation is disruptive and is not a prerequisite to re-evaluating a corrected resource. It risks data loss while confusing reporting delay with persistent configuration error.

Remediation tasks are relevant to supported policy effects that deploy or modify configuration. They are not a general mechanism for immediately refreshing a stale compliance evaluation after resources were already corrected; the policy effect and scan state must be considered.

A noncompliance message changes how a result is described, not when the policy engine reevaluates the resources. The dashboard can still reflect the earlier assessment until the ordinary or triggered scan completes.

Audit would only report the resources as noncompliant and would remove the modification intent for new requests. It provides no action to correct the existing tags.

Compliance evaluation classifies existing resources but does not run the modification operation on them. Repeating it changes reports, not tags, without the required remediation workflow.

AuditIfNotExists can highlight missing related configurations, but it does not execute the modify effect against existing resources. A remediation task with the proper identity is still required.