Microsoft AZ-104 Exam Dumps, Practice Test Questions

Management locks are enforced by Azure Resource Manager, not only by the portal interface. The listKeys management action is a POST-style call and is still blocked by an applicable ReadOnly lock regardless of whether the client uses CLI, PowerShell or the portal. Choose a supported operation or remove the lock through approved governance.

Resource locks do not inherently rotate keys or stop all data-plane reads. The observed failure arises from the management API operation under the lock.

Reader grants some control-plane inspection but does not revoke independent permissions. An inherited lock is the relevant barrier described.

Removing a child lock cannot clear a separate lock inherited from a subscription or resource-group ancestor. The parent assignment remains effective.

An account-level Owner assignment cannot authorize modifying a lock owned at the parent scope, and role grants do not override lock enforcement.

Another lock would add a restriction rather than remove the inherited one. The original parent lock would still block deletion.

Management locks are not a blanket data-plane deny; that assumption leaves data operations exposed to authorized principals.

Legal holds are explicit Blob Storage immutability features and are not created by an ARM management lock.

Azure resources can be protected by ARM locks, but that protection operates on management requests, not every blob payload operation.

Azure management locks evaluate ARM operations, not just whether data is physically erased. A move can require blocked operations even when workloads are intended to survive.

Guest privileges do not override an ARM management lock inherited from a parent scope. They cannot authorize the blocked resource move.

SAS permissions apply to supported storage service operations, not ARM resource-group moves. They cannot override management locks.

VM Contributor normally covers supported power actions. The case deliberately says the role is sufficient; the separate ReadOnly lock is the restriction.

NSG rules govern network packets, not the Azure Resource Manager control-plane operation used to restart a VM. The inherited ReadOnly lock still blocks the management operation regardless of whether RDP traffic is allowed.

VM restart is managed through Compute, not by granting the caller ownership of the underlying managed-disk blobs. The lock remains the operative constraint.

Token refresh is appropriate for stale group claims, but the scenario names an effective ReadOnly management lock. Azure Resource Manager applies that lock to management-plane writes, including creation of storage-account or container-scoped role assignments. Refreshing the same Owner principal does not change the lock’s enforcement and leaves the role assignment blocked.

A service SAS is a signed bearer-token delegation for particular storage operations, not an Azure RBAC assignment to a Microsoft Entra principal. Issuing it would change the authorization model and leave the requested identity-scoped audit trail absent. It also would not repair the ARM role-assignment write blocked by the ReadOnly lock on the storage account.

Contributor does not grant unrestricted roleAssignments/write and cannot ignore a ReadOnly management lock. Even Owner with IAM rights cannot bypass that resource lock by merely changing scope or role. Subscription-level Contributor would expand management access far beyond the intended container and still would not permit the protected nested RBAC assignment write.

A resource group's location is metadata for control-plane management; changing region does not remove an assigned lock. The deletion remains blocked until the protection is intentionally adjusted.

Management locks are enforced through the Azure control plane regardless of whether a caller uses the portal, CLI or REST API. Changing the client cannot bypass the lock.

RBAC resource permissions do not override inherited management locks. An appropriately authorized administrator must remove or adjust the blocking CanNotDelete lock before the otherwise permitted delete operation can proceed.

ReadOnly is more restrictive for management writes and commonly blocks the updates the engineers need. It is the wrong lock type for retaining update capability.

A lock restricts operations and does not grant RBAC permissions. The engineers still need appropriate management Actions to make any permitted changes.

A lock restricts permitted control-plane operations independently of RBAC. Owner is neither required for a normal allowed update nor an override for a blocked deletion; the correct action retains CanNotDelete with appropriate existing permissions.

Tags on a resource group do not automatically propagate to member resources. Relying on inheritance leaves the new VMs without the metadata that the reporting filter expects.

Moving resources changes their container but does not by itself transfer the group’s tags to each resource. The CostCenter values would still be missing.

Cost reporting inheritance can affect how costs are displayed, but does not necessarily write CostCenter into the VM resources. The requirement explicitly concerns resource tags present on deployed VMs.

Action groups route monitoring notifications; they are not an inheritance engine for Azure resource tags. The missing VM tag remains unresolved.

Azure does not automatically copy those tags to child resources. Assuming inheritance explains why the VM property remains empty.

Azure tags can be applied to many individual resource scopes, including a VM and resource group. A subscription-only requirement is incorrect.

Azure Policy compliance evaluation does not confer Azure RBAC permissions. Tags can be evaluated for governance, but authorization to start or manage a VM still comes from actual identity, role assignment and scope.

Modify can remediate supported metadata properties, but a successful tag-compliance result is not an Azure RBAC role assignment and cannot grant start or delete permissions. VM operations still require the principal's applicable role and scope.

Reader has management-plane read permissions, not VM write/start authorization. A resource tag does not elevate a Reader assignment into the required VM management Actions.