Microsoft AZ-104 Exam Dumps, Practice Test Questions

Blob data read is unrelated to deleting an Azure VM resource and would not satisfy the denied Compute management action.

NotActions removes an operation from the custom role's own allowed management actions; it cannot grant the newly approved delete capability.

Deleting the VM resource is an ARM management-plane operation. The custom role must add the matching management Action.

Reader does not have the necessary management rights, and generic customer-managed deny creation is not an ordinary public RBAC feature.

NotActions subtracts permissions within its role; it is not a global deny that overrides grants from other assigned roles.

A CanNotDelete ARM management lock may protect the resource from deletion by a different mechanism, but that lock is not an Azure RBAC deny assignment. Applying a lock does not grant the tenant administrator arbitrary deny-assignment authoring; supported Azure services still manage deny assignments.

Data-plane access is not a transitive grant of Azure Resource Manager write actions. Automatically conferring Contributor would undermine the distinct permission planes.

Custom-role names do not set their effective capabilities. The actual Actions, DataActions, scope and assignments determine what is authorized.

Reading objects in a container is narrower than managing the parent account. The scenario demonstrates precisely why resource management permissions need separate evaluation.

A custom role exclusion is not an explicit deny assignment and cannot revoke rights contributed by an unrelated built-in data role. The separate assignment still matters.

Azure RBAC combines applicable allow grants; it does not use assignment creation order to prioritize an exclusion in another role. A role-level NotDataActions is not an explicit deny, so the separate Blob Data Reader assignment can still authorize the blob read regardless of which assignment came first.

NotDataActions subtracts specified actions from the permissions granted by that custom role. It does not create an ARM deny assignment and therefore cannot cancel a read action granted by a distinct role. Actual deny assignments have different semantics and can block allowed actions, but none is described here.

Descriptive labels do not change authorization behavior. The actual Actions list still grants wildcard operations.

Owner is more powerful and introduces role delegation. It makes the unwanted permission breadth worse.

Reducing AssignableScopes limits where the role can be assigned, but any assignment within that group still receives all Actions matched by the broad wildcard, including future provider operations. Replace the wildcard with reviewed explicit Actions for least privilege.

User Access Administrator is a powerful general role for managing role assignments and is not restricted to Key Vault data-plane roles. Granting it at subscription scope would let the operator delegate access far beyond the requested secret and certificate operations. This breaks the explicit requirement to avoid broad privileged role-assignment authority.

Key Vault Reader is useful for inspecting non-sensitive Key Vault metadata under the RBAC model. It does not include the management-plane role-assignment operations necessary to grant Secrets User or Secrets Officer to other principals. A lead with only Reader would remain unable to perform the access-delegation task described.

Key Vault Secrets User authorizes reading applicable secret values; it is not an administrative role for assigning other people Azure RBAC permissions. Giving the lead this role would potentially expose secret contents while failing the requested delegation workflow. It confuses a data-consumer permission with the role-assignment control plane.

Owner includes extensive resource writes and RBAC delegation, exceeding the described need. A specialized policy role is designed to isolate governance operations.

Virtual Machine Contributor is focused on VM management, not the Azure Policy resource provider's assignment operations. It would both mis-scope and miss key tasks.

Reader can inspect many resource configurations but cannot create or change policy assignments. Visibility does not confer the write actions the officer must perform.

Workspace query rights do not grant the Microsoft.Insights management write permissions needed to deploy alert rules and action groups into the target resource groups. Monitoring Contributor at the corresponding resource scope is the more targeted management role.

Monitoring Reader allows viewing monitoring information but does not include the write operations needed to create rules and action groups. Read-only access would leave alert provisioning blocked.

Azure RBAC permissions apply at their assignment scope and descendants; a role on a workspace does not automatically cover separate alert-rule and action-group resources outside that scope. Assign the needed monitoring role where those resources are created.

A network-specific role addresses network resources, not the required VM life-cycle actions. The engineer would still lack the VM management actions needed to restart the fleet.

Reader can inspect the VM configuration but cannot execute VM state changes. The required restart needs a write/action permission, not merely visibility.

Owner grants full management and role delegation over the whole subscription. That exceeds both the workload restriction and the explicit prohibition on assigning other users' access.

Adding another management-plane Reader grant still does not authorize downloading blob bytes. Changing scope of an insufficient role cannot supply the missing DataActions.

The case explicitly disables Shared Key authorization, and circulating a shared key violates the per-user identity requirement. A rotated key is not a substitute for Entra blob data-plane RBAC.

Anonymous read can expose the dataset beyond the investigator and bypass the intended identity-based control. It would turn a least-privilege access problem into a public-data risk.

Querying existing records does not require the resource-management writes that Contributor provides. The role would exceed the investigator's nonadministrative need.

Monitoring Reader on a VM does not automatically grant the job permission to query the Log Analytics workspace's data under its selected access-control mode. Grant the needed workspace log read capability at an appropriate scope.

Azure Monitor Contributor includes broad monitoring configuration writes beyond the stated query-only task. Query access should start with an appropriate read role and workspace access-control mode.