Microsoft AZ-104 Exam Dumps, Practice Test Questions

Azure resources do not need subscription Owner to be evaluated against initiative definitions. Such grants are unrelated and excessive.

A policy assessment can identify gaps without writing resources. Remediation requires an applicable effect and authorized task.

Deleting assignments eliminates enforcement and would undermine the intention of extending governance coverage.

The initiative display name is general metadata for the policy set and isn't the per-definition violation message selector. Changing it labels the whole collection and wouldn't associate remediation instructions with the one encryption rule. The assignment needs a nonComplianceMessages entry that references the intended member definition.

notScopes excludes resource scopes from a policy assignment; it doesn't address individual initiative definitions by member ID and doesn't carry a custom message. Using it would remove resources from evaluation rather than improve the encryption finding text. The intended scope and underlying controls must stay intact.

An exemption records an allowed deviation from a policy assignment for particular resources or subscopes. It is inappropriate when compliance officers only want an explanatory message for violations that still need correction. Exempting every failing resource would mask noncompliance instead of communicating the targeted remediation instruction.

Waiver records why an exception is temporarily accepted; it does not filter resources by their Azure region. Without a location-specific selector, the exemption might cover every otherwise applicable resource within the resource-group scope.

PolicyDefinitionReferenceIds identifies the particular policy definitions inside an initiative to exempt. A geographical Azure region is not an initiative definition reference. This property cannot by itself distinguish two resource locations under the same exemption scope.

Assignment notScopes excludes a complete child scope from evaluation. Excluding the whole resource group would also suppress evaluation of the East US resources, violating the requirement to continue applying policy there. The condition belongs to the exemption, not a broad assignment exclusion.

The assignment identity handles the deployment action for DeployIfNotExists. Since that managed identity already has diagnostic-settings write permission, giving it the same ability again doesn't solve an existence-check read failure. Azure Policy evaluates related resources during a create/update request using the requestor's identity, which is a different authorization boundary.

DeployIfNotExists uses a managed identity attached to the policy assignment for its ARM template deployment and remediation. Removing it would break deployment authority, and it wouldn't grant the requesting principal read access for the existence evaluation. The two principals are intentionally used for different operations.

DeployIfNotExists uses an existence check to inspect a related diagnostic setting. The principal performing this evaluation still needs its required read capability; supplying only a write Action does not satisfy that read requirement. The assignment's separate remediation identity already has write access.

A system-assigned managed identity belongs to the lifecycle of its parent assignment. Deleting and recreating that assignment can create a different principal ID, so the former role assignments cannot be relied upon.

The replacement system-assigned identity has its own principal; role grants to the deleted or old identity do not automatically transfer. A reusable user-assigned managed identity is appropriate when the principal must persist independently.

A system-assigned principal is tied to its resource lifecycle and may be replaced on recreation. Old RBAC assignments cannot be assumed to target the new identity.

That hides the difference between meeting the rule and being excused from it. Compliance reporting would overstate the number of resources actually configured according to policy.

Removing an exemption restores normal evaluation but does not change the resource's properties. The resource may correctly appear noncompliant after reassessment.

Owner permissions concern management operations, not the semantic distinction between exemption and rule satisfaction. The dashboard's compliance state is a governance classification.

notScopes excludes whole resource scopes from assignment applicability, not selected Azure regions across every subscription. Renaming a policy assignment doesn't turn scope exclusion into resourceLocation selection, and subscriptions can contain resources in many regions. This could wrongly exclude East US resources that reside in the same excluded subscription.

An exemption describes an accepted exception for targeted resource scopes and can itself have resource selectors, but the request explicitly wants staged assignment applicability without exemptions. A single resource-group exemption also wouldn't select all resources in a region across the entire management-group hierarchy. Assignment resourceSelectors are the appropriate rollout mechanism.

DoNotEnforce changes whether the policy effect is enforced during requests; it does not inherently restrict which locations are evaluated. The requirement is a phased set of evaluated resources while keeping the assignment scope fixed. Resource selectors supply that regional filter, and enforcement mode is a separate dimension.

A ReadOnly lock would also block management-plane updates such as firewall changes. That violates the requirement to keep authorized configuration maintenance available.

Changing administrators to Reader would block their authorized updates, and other privileged users might still retain deletion rights. RBAC reassignments do not implement the required shared safety lock.

The audit effect reports policy noncompliance rather than preventing a deletion. A reported event after a destructive request is insufficient to satisfy the prevention requirement.

CanNotDelete stops removal but does not stop updates by principals with write rights. It does not freeze management-plane configuration during the legal hold.

An audit effect observes noncompliant configurations but does not bar management-plane changes. It cannot guarantee the resource remains unchanged during the hold.

A Reader assignment limits a particular principal, not every administrator. Other existing write-role holders could still change the resource unless a lock or comparable enforcement exists.

An Owner assignment does not make Azure Resource Manager disregard an inherited CanNotDelete lock. A properly authorized administrator would need to manage the lock explicitly before deletion, while a direct child deletion remains blocked as long as the resource-group lock applies. The guest OS or extra role grant is not the mechanism that explains the error.

Even if no lock is attached directly to the child VM, the CanNotDelete lock at its resource-group ancestor is inherited in the VM's ARM scope. Removing only VM-level locks would not eliminate the higher-scope blocker. The administrator must address the inherited group lock before the delete request can proceed.

Availability-zone placement relates to placement and resiliency, not the inherited resource-lock evaluation that prevents the delete request.

Management locks are enforced by Azure Resource Manager, not only by the portal interface. The listKeys management action is a POST-style call and is still blocked by an applicable ReadOnly lock regardless of whether the client uses CLI, PowerShell or the portal. Choose a supported operation or remove the lock through approved governance.

Resource locks do not inherently rotate keys or stop all data-plane reads. The observed failure arises from the management API operation under the lock.

Reader grants some control-plane inspection but does not revoke independent permissions. An inherited lock is the relevant barrier described.