Microsoft AZ-104 Exam Dumps, Practice Test Questions

Audit would only report the resources as noncompliant and would remove the modification intent for new requests. It provides no action to correct the existing tags.

Compliance evaluation classifies existing resources but does not run the modification operation on them. Repeating it changes reports, not tags, without the required remediation workflow.

AuditIfNotExists can highlight missing related configurations, but it does not execute the modify effect against existing resources. A remediation task with the proper identity is still required.

A resource lock prevents management-plane updates or deletions at its scope, but cannot express separate allowed-location, tag, and encryption compliance rules.

Individual assignments can enforce separate policies but do not create the requested single managed compliance package. An initiative groups definitions and parameters under one assignable unit.

An allowed-location rule alone cannot evaluate the unrelated tag and encryption requirements. The governance requirement calls for multiple coordinated definitions combined in an initiative.

Changing enforcement for the entire subscription affects compliant and noncompliant resources beyond the one approved legacy workload. The requirement is a narrowly scoped, time-limited and auditable exception for a single resource while policy remains in effect elsewhere, which a resource-scoped expiring exemption provides.

Deleting the shared policy definition removes its protective evaluation for every resource that depends on it, which exceeds the one legacy exception authorized by governance. It also destroys the intended migration deadline rather than recording a temporary waiver with an expiry. The subscription should keep the original rule, with a separate, narrowly scoped exemption that can be reviewed and audited.

An assignment notScopes exclusion removes the entire subscription from evaluation and does not model the approved one-resource, time-bounded exemption. A scoped exemption with expiresOn maintains the intended documented exception.

The monitored VM’s system-assigned identity is an application principal used by the workload; it is not necessarily the managed identity attached to the Azure Policy assignment performing remediation. Giving that VM identity Blob Data Reader would only permit specified blob reads and cannot create VM diagnostic settings through ARM. Inspect the policy assignment identity and its deployment-related role permissions instead.

AuditIfNotExists inspects related resource state and records a compliance finding when the expected diagnostic resource is absent. It does not execute the DeployIfNotExists template that would create the missing setting. Switching to audit would make the problem observable but would not satisfy the requirement for successful remediation; retain the deployment-capable effect and fix the identity authorization error.

Reader grants Azure Resource Manager visibility but not the write Actions necessary to deploy the missing diagnostic setting. Even if the managed identity can see the VM and workspace, a remediation deployment will fail when it tries to create or modify resources without the relevant rights. The assignment identity needs least-privileged deployment permissions, not another read-only role.

Disabling every definition would suppress location and diagnostics controls the organization expressly needs to retain on the testing resource.

Unassigning the initiative would eliminate governance coverage beyond the one permitted exception. It also affects resources not involved in the test.

A broad group exemption without a reference selection would waive additional controls, including the required region and diagnostic logging checks.

A policy exemption documents a waiver or mitigation for applicable rules and can be counted as exempt in compliance. The request is to exclude the lab from policy assignment applicability altogether.

Owner grants management privileges but does not exclude the subscription from inherited policy assignment evaluation.

Disabling the definition alters governance for every scope using it, whereas the lab is the only desired exception. The definition should remain active elsewhere.

Standalone assignments do not inherit input values from an initiative that is not the policy assignment being evaluated. The reusable initiative must declare an allowed-location parameter and explicitly map it to member definitions.

Matching names do not automatically wire the initiative assignment value to each member definition. The initiative definition must explicitly pass the common parameter into its components.

A display name identifies the policy but does not establish a parameter expression. The requested assignment-time value will not be forwarded into each child definition.

Waiver signals that the organization accepts a noncompliant state, generally as an exception; it does not express that the original security intent is already met elsewhere.

DoNotEnforce changes enforcement for an assignment scope and is too broad; it is not a specific exemption explaining how this VM meets the requirement.

The exemption category communicates the reason for accepting noncompliance. Waiver records an accepted exception, while Mitigated is the appropriate category when an alternative control already meets the requirement; narrative text alone does not change the category.

An exemption does not become a notScopes exclusion when it expires. The policy assignment structure and scope remain unchanged.

Expiration is a property of the exemption, not a destructive operation on the governing policy definition. Other resources continue to be assessed.

The object remaining visible does not mean it remains effective. A time-bound approval is not an indefinite waiver simply because its audit record persists.

existenceScope changes where related resources are searched, not the properties that qualify them as correct. Expanding the search to an entire subscription could even find another unrelated diagnostic setting while leaving this VM's incorrect workspace destination unchallenged. The case requires value-based evaluation on the related diagnostic setting, not just a wider search location.

Reader can be useful when evaluating resources, but the stem says the policy successfully finds existing settings and incorrectly accepts their wrong destination. Adding read permissions alone doesn't change the predicate from 'resource exists' into 'resource targets approved workspace'. The rule needs an existenceCondition on the actual destination property.

Disabling the effect bypasses the policy enforcement and compliance result rather than ensuring logs arrive at the approved workspace. The VM's wrong diagnostic destination would persist and governance would lose its promised guarantee. A more precise related-resource existence condition is required before deciding whether the deployment should run.

Azure resources do not need subscription Owner to be evaluated against initiative definitions. Such grants are unrelated and excessive.

A policy assessment can identify gaps without writing resources. Remediation requires an applicable effect and authorized task.

Deleting assignments eliminates enforcement and would undermine the intention of extending governance coverage.