Microsoft AZ-104 Exam Dumps, Practice Test Questions

Scoping the administrator into an ordinary-user SSPR group does not remove the separate administrator reset policy. In this established tenant the administrator must satisfy the privileged two-gate reset checks even when ordinary users are allowed a one-method flow. Group inclusion can govern whether users are enabled for a standard user policy, not rewrite the administrator-specific verification standard.

The administrator-specific SSPR policy does not depend on the tenant Authentication methods policy in the same way as ordinary user method availability. Disabling a method there does not change the required two separate authentication data gates for this Global Administrator. It might affect other sign-in or registration experiences instead, without solving the requested privileged reset-policy restriction.

The stronger standard administrator reset policy generally requires two pieces of authentication data, not an unconditional three. The question specifies a verified-domain established tenant, so the normal two-gate rule rather than a new-trial one-gate exception applies. Requiring exactly three would invent a threshold that this Microsoft Entra SSPR scenario does not support.

Setting SSPR Properties to All would change the separate eligibility boundary and could include employees outside the intended reset population. It does not supply group-scoped SMS method authorization in a tenant using the unified policy. Eligibility for SSPR and which verification methods are enabled are distinct policy decisions and must both be correct.

Migration Complete means the legacy MFA/SSPR authentication-method controls no longer determine ordinary method availability for the migrated tenant. Editing those settings cannot establish the requested group-scoped SMS authorization. The team needs the unified Authentication methods policy rather than an obsolete method switch; exceptions such as legacy security questions are separate.

Changing the required count alters how many approved proofs a user must provide, not which methods are made available. If SMS is disabled for the pilot in the unified Authentication methods policy, increasing the count will not make it usable and could further reduce employees' ability to complete SSPR.

Writeback is a password-change delivery mechanism from a supported cloud-recognized identity to an on-premises directory; it does not create Microsoft Entra user objects for accounts that exist only in AD DS. Without corresponding identities eligible for cloud SSPR, there is no supported reset event from which the writeback service can propagate a password.

Password hash synchronization primarily supports the on-premises-to-cloud credential path. Explicitly excluding the employees from directory synchronization leaves the cloud without their identities, and omitting SSPR enrollment leaves them unable to complete its recovery workflow. Enabling a password-related sync feature alone does not create eligibility or reverse reset changes.

A group membership that exists only in an unsynchronized on-premises directory is not automatically an eligible Entra SSPR assignment for an absent cloud user. The Selected option applies to Microsoft Entra groups and recognizable tenant users. Supported identity synchronization and enrollment must precede a workable hybrid SSPR reset and writeback flow.

Virtual Machine Contributor permits virtual-machine management operations such as start, stop and configuration changes at its assigned scope. Although that role can inspect a VM, it would also let the platform engineer change power state or related VM settings, violating the explicit read-only requirement. Choosing a workload-specific Contributor role is therefore not least privilege when the task is inspection without operation.

Contributor is broader than required: it allows most Azure resource management operations across the assigned resource group, including VM modifications and deletion, even though it excludes ordinary IAM role assignment. A platform engineer with Contributor could change the machines being inspected rather than simply view them. The read-only Reader role achieves the necessary visibility without authorizing disruptive changes.

Role Based Access Control Administrator manages Azure role assignments and related authorization operations. It is appropriate for an access officer who must delegate roles but does not need general VM administration. This engineer explicitly must not delegate access and only needs to inspect VM state, so a role-management role would provide the wrong permissions while failing to improve the read-only inspection task.

Contributor grants broad resource management Actions but does not normally include Microsoft.Authorization/roleAssignments/write, so it is not the standard role for creating or revoking Azure RBAC assignments. Assigning Contributor to the access officer would permit resource changes the officer must not perform while still omitting the IAM delegation capability that the scenario requires.

Virtual Machine Contributor supports VM deployment and operational management within its scope, including power and configuration actions. It is not an IAM authorization administration role. The access officer is responsible for granting and revoking resource-level role assignments, not for administering VM state; providing VM Contributor would be both irrelevant to that duty and unnecessarily permissive.

Reader provides visibility into Azure resource metadata and existing access configurations but cannot create or delete role assignments. It is valuable for audit personnel who inspect authorization, not for officers who must independently grant and revoke access. The requested IAM writes require a role containing the appropriate Microsoft.Authorization operations, with a scope appropriate to the affected resources.

The deployment account already has Microsoft.Authorization/roleAssignments/write permission, so broadening it to subscription Owner would not resolve a transient PrincipalNotFound response. It introduces excessive management and delegation privileges while the actual failure is directory replication timing for the newly created identity principal.

The principalId property identifies the Entra service principal object that receives the RBAC role, not an application/client ID or the friendly managed-identity resource name. Substituting another identifier can point authorization at the wrong principal or fail validation; it does not address cross-region propagation of the new object.

A deployment dependency orders creation of the managed identity before the RBAC extension resource, but it does not guarantee that the backing Entra service principal has replicated to every authorization region at that instant. The documented mitigation is to specify the new principal type, not to assume deployment ordering is a directory-replication barrier.

Azure Reader is a control-plane role for viewing resource configuration and other management metadata. Giving it a broader subscription scope would let the analyst see more vault resources but would not add the data-plane permission needed to call Get Secret and retrieve a secret value. Scope expansion cannot manufacture missing data actions.

Key Vault Reader is a vault data role that reads metadata for keys, secrets and certificates but explicitly cannot read sensitive secret values. Confusing metadata visibility with Get Secret is the same access-boundary error observed in the case. A Key Vault Secrets User permission is an example of a role granting secret-value reads when assigned appropriately.

The management plane and vault object/data plane have separate authorizations. Selecting Azure RBAC as the vault authorization model does not merge their role sets or convert Reader into a secrets reader. Without a relevant vault data role, the analyst can continue to inspect the vault resource while secret-value access remains forbidden.

Owner provides broad role grants but does not override an applicable Azure RBAC deny assignment. Repeating the action with the same permissions would leave the prohibition in force.

User Access Administrator governs access management, not an unconditional ability to bypass protection imposed by deny assignments. Adding another role cannot cancel that denial.

Management locks and deny assignments both can prevent deletion, but the scenario explicitly identifies a deny assignment. Removing an unrelated lock would not erase the applicable RBAC denial.

Contributor allows broad management of many resource providers across the subscription, including compute. The contractor needs the network provider actions within one resource group, not broad deployment privileges.

This role focuses on role assignments and does not supply the required broad Microsoft.Network management actions. It would enable the very access delegation that is prohibited.

Reader lets the contractor inspect NSGs, route tables and VNet properties but lacks the management write Actions needed to modify them. Network Contributor at the targeted resource-group scope provides the relevant network writes without general compute or IAM delegation.

Deleting an Azure VM is a resource management-plane action, not blob or VM guest data access. The premise about data actions is false.

Entra tenant directory administration is not a prerequisite for deleting a VM with proper Azure RBAC rights. Resource authorization is evaluated at Azure scope.

NotActions has no universal-deny behavior; it only affects the set granted by its own role. Another assignment can restore the same action.

Blob data read is unrelated to deleting an Azure VM resource and would not satisfy the denied Compute management action.

NotActions removes an operation from the custom role's own allowed management actions; it cannot grant the newly approved delete capability.

Deleting the VM resource is an ARM management-plane operation. The custom role must add the matching management Action.