100% Latest & Updated Microsoft AZ-104 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 190
A cloud governance lead wants the same subscription under two peer management groups so each can pass separate inherited policies onto it. The lead asks whether a subscription can have both direct management-group parents. Which design constraint applies?
- Assign a policy initiative to the subscription and treat that as adding a second management-group parent
- A subscription belongs to a single management-group hierarchy path at a time
- A subscription can have unlimited simultaneous direct management-group parents
- Assign one subscription to two peer management groups by adding a second management-group parent ID to its resource metadata
Explanation
Correct Answer
B:An Azure subscription has one direct management-group parent in the hierarchy. Common policies should be placed at a shared ancestor or coordinated through multiple assignments.
Incorrect Answers
A:A policy initiative assigned directly at subscription scope is not a second management-group parent. The hierarchical parent rule remains one path even when multiple policies apply at different scopes.
C:Multiple direct parents would give the same subscription conflicting hierarchy ancestry; Azure management groups use a tree, not a many-parent graph.
D:Azure management groups form a tree, so a subscription cannot have two direct management-group parents. Fabricating or editing an extra parent ID is not a supported way to inherit a second peer group’s policies; use a shared ancestor or assignments.
Question 191
A central security baseline applies to all subscriptions under a management group. A new subscription is moved into that group and must receive the same existing location restrictions. What happens to the policy assignment at the parent scope?
- Its policy assignment evaluates resources in the new descendant subscription within the inherited scope
- The assignment is copied as an independent new definition inside every resource group
- Only subscriptions created before the assignment date are included
- Recreate the same policy assignment separately on every newly attached subscription because management-group assignments cannot inherit
Explanation
Correct Answer
A:Azure Policy assignments at a management group apply to descendant subscriptions. Moving the subscription under the governed parent brings it within the assignment’s evaluation scope.
Incorrect Answers
B:Inheritance does not require creating an identical definition per resource group. The management-group assignment already supplies the controlling scope.
C:Inheritance is based on current hierarchy scope; new descendant subscriptions become subject to applicable assignments when incorporated.
D:Azure Policy assignments at a management group apply to resources in descendant subscriptions within the applicable scope. Duplicating the inherited assignment on each new subscription is unnecessary and incorrectly denies the governance inheritance model.
Question 192
A subscription is transferred from management group Pilot to management group Regulated. Regulated already has a stricter Azure Policy initiative assigned, while Pilot has a permissive initiative. What compliance behavior should the administrator expect?
- Preserve a direct subscription policy assignment and assume it pins all previously inherited Pilot initiatives after the move
- Only Azure storage data-plane roles are re-evaluated, never Azure Policy
- The subscription retains the Pilot policy solely because it had that parent yesterday
- Applicable inherited Azure Policy assignments change with the new management group ancestry
Explanation
Correct Answer
D:The subscription becomes subject to policies inherited through its current management group chain. Administrators should validate new compliance and potential deployment denials before moving the subscription.
Incorrect Answers
A:A direct subscription assignment can remain independent, but inherited initiatives come from the current management-group ancestry. Moving under Regulated changes which management-group policy assignments flow down to the subscription.
B:Azure Policy is a governance service whose assignments can be inherited from management groups; it is not limited to storage data-plane authorization.
C:Inherited rules follow the active scope hierarchy rather than remaining fixed to a previous parent forever.
Question 193
The cloud team has a tenant root management group and plans a hierarchy of business-unit groups. They worry that creating the first child management group will automatically relocate all existing subscriptions into it. What should they expect?
- Existing subscriptions are copied under both the root and new child group so each retains root policy inheritance
- Subscriptions whose display names resemble the new management-group name are moved into it automatically
- Subscriptions retain their assigned management-group placement until explicitly moved
- Creating a new child group automatically changes the inherited access and policy scope of subscriptions elsewhere in the hierarchy
Explanation
Correct Answer
C:Creating a management group establishes a new possible governance scope, not an implicit subscription migration. Existing subscriptions stay under their current parent management group until an authorized administrator performs a move. Any RBAC or Azure Policy inheritance change depends on the actual parent path, allowing the hierarchy to be introduced without unexpectedly re-scoping unrelated subscriptions.
Incorrect Answers
A:A subscription can have only one direct management-group parent. Root-level policy inheritance works because root is an ancestor of child subscriptions, not because subscriptions are duplicated under multiple branches. Creating a child group therefore does not make a second copy of existing root subscriptions.
B:Management-group membership is set through explicit hierarchy placement rather than a subscription display-name match. Names may help administrators navigate a business-unit design, but no automatic matching process moves existing subscriptions merely because the new child group resembles their labels.
D:A new child group only affects resources that are ultimately placed under that group and inherit assignments from that path. Sibling or root-owned subscriptions do not automatically take on access controls targeted at the new child. Any broader root-level policy assignments continue to apply through the existing ancestor relationship.
Question 194
An architect tries to move a single VM resource directly into a management group to apply governance without moving its subscription. Azure does not offer the operation. What hierarchy distinction is being missed?
- Assign Reader to the VM to make it moveable into the management group
- Management groups contain other management groups and subscriptions, not individual Azure VMs as direct children
- A management group can contain only Azure virtual networks
- Move the VM into a resource group whose name matches the management group and assume it becomes a direct child of that management group
Explanation
Correct Answer
B:Policy and RBAC assigned to a management group flow through its descendant subscriptions to their resources. Individual resources remain in resource groups under subscriptions; they are not reparented directly.
Incorrect Answers
A:RBAC read permission does not change the valid resource hierarchy or which object types a management group can contain.
C:Management groups are administrative hierarchy nodes for subscriptions and child groups. Virtual networks remain ordinary subscription resources.
D:Resource-group names do not change the Azure hierarchy. A VM belongs to a resource group under a subscription, and a management group contains subscriptions and nested management groups. Matching names cannot turn the VM into a direct management-group child.
Question 195
An Azure administrator has Owner at a subscription and Contributor on the destination management group. They are moving that subscription from one nonroot management group to another but lack management-group write access on the current parent. The move fails. What permission boundary explains the failure?
- Reassign subscription Owner to the operator and retry, without obtaining access on the source management group
- Grant management-group write access only on the destination parent and assume subscription Owner covers the source parent
- Create another subscription under the target group and assume the original subscription is moved
- Ensure the mover has the documented child subscription permissions and management-group write permissions at the source and destination parents
Explanation
Correct Answer
D:Changing a subscription's management-group parent affects inherited governance and requires authorization on multiple nodes. The current parent cannot be bypassed simply because the mover has permissions at the destination.
Incorrect Answers
A:Subscription Owner already exists in the scenario, and repeating it cannot grant Microsoft.Management/managementGroups/write at the current parent management group. The mover needs the documented source-parent and destination-parent hierarchy privileges as well as subscription permissions.
B:Destination-parent access alone is insufficient for reparenting an existing child. Removing the subscription from its current management group changes that parent's hierarchy and requires source-parent authorization; Owner on the subscription does not silently supply permissions on the parent management group.
C:Provisioning a separate subscription does not transfer the existing subscription, resources or governance scope. It leaves the blocked source subscription unmoved.
Question 196
An Azure subscription was moved successfully from management group Pilot to Regulated. Five minutes later, an administrator sees the old management-group path in one Azure portal view and suspects the move failed, even though the management API already reports the new parent. What timing behavior should be considered before repeating the move?
- A management-group hierarchy move always changes the Azure regions of resources; the portal waits for their disks to migrate
- A resource-group Reader assignment is needed to force portal management-group parent metadata to update synchronously
- Azure Resource Manager can cache management-group hierarchy details for up to about 30 minutes, so a portal display may temporarily lag a successful move
- Management groups permit a subscription to have both Pilot and Regulated as direct parents during a 24-hour synchronization period
Explanation
Correct Answer
C:Microsoft documents that Azure Resource Manager caches management-group hierarchy information for up to 30 minutes. After a valid subscription move, an Azure portal view can briefly show the old parent even while the management API reports the new one. Check authoritative state and allow cache convergence rather than initiating a redundant, potentially disruptive second move.
Incorrect Answers
A:Management-group hierarchy changes affect governance ancestry, not the physical region of VMs or their disks. The reported discrepancy is between an already updated management API path and a portal display five minutes later; there is no region migration to wait for. A different operation cannot explain a short-lived cached view of hierarchy metadata.
B:A Reader role at the resource-group scope can permit management visibility for resources in that group, but it cannot flush Azure Resource Manager hierarchy caches. The API already shows the new subscription parent. Assigning additional RBAC rights would neither make the previous move more valid nor guarantee instantaneous portal display refresh.
D:A subscription can have only one direct management-group parent in a directory hierarchy. Cache delay does not create a legitimate second parent or simultaneous inheritance from two peer groups. Treating temporary UI lag as dual membership would produce an incorrect governance interpretation, especially for policy inheritance and RBAC inheritance decisions.
Question 197
A cloud governance team is retiring an empty departmental management-group branch. The team has write permission on the branch, but its delete operation fails while a subscription and a nested management group remain beneath it. What must happen before deletion can succeed?
- Move the child subscription and nested management group out to valid parent management groups, then delete the now-empty branch with sufficient permissions.
- Change the branch display name and retry the deletion while all children remain attached.
- Move only the virtual machines to another resource group because management-group children are not checked.
- Disable all subscription resource providers; management groups can then delete child subscriptions automatically.
Explanation
Correct Answer
A:Azure does not delete a management group while it still contains child management groups or subscriptions. The operator must reparent those child objects to valid destinations, retaining the organization hierarchy, and then delete the empty group with appropriate permissions. This is a child-dependency prerequisite, not a way to delete the resources or subscriptions themselves.
Incorrect Answers
B:A display name is an identification property, not the relationship that prevents deletion. Renaming the group may help administrators recognize it, but Azure still sees the same subscription and nested management-group children. The deletion precondition remains unsatisfied until those hierarchy memberships are moved or removed appropriately.
C:Virtual machines are resources within subscriptions and resource groups, and the error concerns management-group child hierarchy nodes. Moving VM resources could disrupt deployment or permissions without changing the subscription and nested group beneath this branch. The correct task is to change the management-group parent relationships rather than relocate workload assets.
D:Azure resource providers register services for a subscription; their registration state does not authorize destruction of child subscriptions when deleting a governance group. Disabling providers would create deployment failures or other unwanted effects. Deleting a management group requires it to have no subordinate subscriptions or groups and the caller to have suitable write access.
Question 198
An organization has a custom Entra directory role permitting user-management actions. The same administrator tries to modify a VM in an Azure subscription and receives authorization denied. What boundary must be addressed?
- Scope the custom Microsoft Entra directory role to an administrative unit and assume that unit can contain the Azure VM resource
- Assign Privileged Role Administrator in Microsoft Entra ID, expecting that directory role to include subscription VM changes
- Grant an appropriate Azure RBAC resource-management role at the target VM or ancestor scope
- Change the Entra directory-role definition’s directory scope to the Azure subscription ID instead of creating an Azure RBAC role assignment
Explanation
Correct Answer
C:Directory roles govern Entra tenant management. Azure resources evaluate separate ARM role assignments; having a high directory role does not automatically authorize VM configuration changes.
Incorrect Answers
A:Microsoft Entra administrative units scope directory object administration, not ARM VM resources inside subscriptions. Placing a directory role on an administrative unit cannot grant Microsoft.Compute update permissions on the VM; Azure RBAC must be assigned at a resource management scope.
B:Privileged Role Administrator manages Microsoft Entra role assignments but does not by itself grant Azure Resource Manager permissions over virtual machines. An appropriate Azure RBAC assignment at the VM, resource group, or subscription scope is still necessary.
D:Entra directory-role definitions and ARM resource-role assignments are separate authorization systems. Setting a directory role scope cannot substitute for an Azure RBAC role granting Microsoft.Compute virtual machine write actions at the subscription or VM.
Question 199
A project’s monthly Azure spending is approaching the amount finance allocated. The team wants an automatic warning at 80 percent of the planned monthly amount, while workloads remain available and spending is not forcibly stopped. Which Azure capability should it configure?
- Azure Cost Management budget with an 80 percent alert threshold
- A ReadOnly resource lock on every project resource
- An Azure Policy deny assignment for all compute resources
- Use Azure Advisor cost recommendations without a project budget alert threshold
Explanation
Correct Answer
A:An Azure Cost Management budget can notify stakeholders when a configured actual or forecasted threshold is crossed. A budget is an alerting and tracking mechanism, not a blanket spending cap or shutdown action.
Incorrect Answers
B:ReadOnly locks interfere with administrative changes to resources but are not based on cumulative spending. They could disrupt operations without delivering the required cost threshold alert.
C:A deny policy for compute blocks deployments based on resource configuration, not a monthly cost threshold. It would overconstrain operations and still fail to provide the precise budget warning.
D:Advisor can recommend optimization opportunities, but a recommendation does not track this project against its monthly allocation or deliver a notification exactly at the chosen 80 percent threshold.
Question 200
A cost analyst sees Azure Advisor flag an underutilized VM for potential resizing. The operations team must assess application capacity before approving any resize. How should the recommendation be treated?
- Immediately resize the VM to the cheapest recommended SKU without checking its peak CPU and memory demand
- As decision support to review utilization, constraints and business risk before changing VM size
- As an instruction that automatically resizes the VM on the next billing cycle
- Automatically schedule the recommended VM resize without confirming supported SKUs or availability constraints
Explanation
Correct Answer
B:Azure Advisor surfaces optimization opportunities, not a mandatory resize. An administrator should validate the workload performance and size availability before executing a change.
Incorrect Answers
A:Advisor can flag underutilization from observed performance history, but an instantaneous resize based solely on estimated savings could exceed peak capacity limits or violate application performance requirements. The recommendation is input for operations validation, not sufficient approval by itself.
C:A cost recommendation does not itself perform a VM resize. Assuming automatic action bypasses the required operations review.
D:A resize must still be assessed for regional SKU support, outage risk and workload resource needs. Turning the advisory finding into an unattended change skips the explicit operations evaluation required by the scenario.
Microsoft Azure Administrator (AZ-104) Practice Tests
