Microsoft AZ-104 Exam Dumps, Practice Test Questions

Querying existing records does not require the resource-management writes that Contributor provides. The role would exceed the investigator's nonadministrative need.

Monitoring Reader on a VM does not automatically grant the job permission to query the Log Analytics workspace's data under its selected access-control mode. Grant the needed workspace log read capability at an appropriate scope.

Azure Monitor Contributor includes broad monitoring configuration writes beyond the stated query-only task. Query access should start with an appropriate read role and workspace access-control mode.

DNS Zone Contributor manages DNS records, not backup policy creation or recovery job actions. It would not authorize the required protection-management tasks.

Backup Reader is intended for inspection and reporting rather than modifying policies or starting privileged protection operations. Its limited write capability fails the requirement.

Owner includes broad resource management and role-assignment authority that the team explicitly disallows. Such privileges are not required for every routine backup policy operation.

AssignableScopes controls where a role definition may be assigned, not where an existing assignment grants actions. A VM-level assignment does not cover its sibling VM regardless of a broader assignable-scopes declaration.

Resource-level role assignments do not propagate sideways to sibling resources. The assignment hierarchy flows downward from a parent, not horizontally among peers.

An action in a definition describes a possible operation, not an unrestricted assignment. RBAC always evaluates the principal's actual assignment scope for the target resource.

A broader management scope still does not add blob content DataActions to the Contributor definition. Expanding unrelated permissions leaves the authorization mechanism unchanged.

A firewall bypass may affect permitted network paths, but does not grant the Azure Storage Blob data-plane permissions required for content writes using Entra authentication. A data role is still required.

The management Reader role exposes ARM resource metadata; it does not add Storage Blob Data Contributor actions needed to upload or modify Blob content with Entra credentials.

Assigning Reader again at each resource group would duplicate an effective subscription-scope grant. The resource group sits under that scope, so inheritance already provides the needed read permissions.

A wider scope affects where a role is effective, not its allowed actions. Reader never becomes a write role merely because new storage accounts appear inside the subscription.

Reader permits viewing resource properties as well as the parent resource group, subject to any separate data-plane authorization rules. It is not limited to listing group names.

A tenant-root assignment could reach many unrelated subscriptions and resources. It breaks the stated separation of duties and grants far more scope than Finance administration requires.

Subscription scope automatically includes both Finance and Research. Even with the correct role actions, its scope would let the technician operate machines in the prohibited group.

Adding Research directly supplies access the policy explicitly forbids. It does not improve Finance operation; it broadens the technician’s authority into unrelated machines.

Reader on the sibling VM permits inspection, not VM management. The VM Contributor role assigned to the first VM is not inherited by a sibling; effective permissions combine only assignments that apply at the particular resource's scope and ancestors.

Assigning a scoped role does not subtract separately inherited Reader access. The user should still be able to inspect permitted sibling resources.

Azure role assignments are scoped to management groups, subscriptions, resource groups, or resources. A VM-specific assignment does not automatically grant rights tenant-wide.

Azure RBAC inheritance flows from parent management group to subscriptions, not from one sibling subscription sideways to the others. A role on the largest subscription will not cover existing or future peer subscriptions.

A role assigned to one subscription is not inherited sideways by sibling subscriptions. New subscriptions would still be missing access.

Resource-group roles affect that resource group and its child resources; they do not grant permissions across other subscriptions or management-group descendants.

Activating a Global Administrator role through Microsoft Entra Privileged Identity Management activates directory privileges, not automatically Azure Resource Manager roleAssignments/write at the subscription. Without the explicit Access management for Azure resources elevation or another pre-existing Azure RBAC delegation, the attempted IAM assignment lacks authorization. Activation can be a prerequisite to using the temporary recovery toggle, but is not the complete recovery mechanism.

Adding another person to the Microsoft Entra Global Administrator role expands directory-administration privileges but does not by itself grant that person Azure subscription Owner or User Access Administrator. The proposed second employee would face the same ARM access boundary. For this emergency, the current authorized Global Administrator should first perform temporary documented root-scope elevation, delegate narrowly, then remove elevated access.

Azure Policy enforcement governs compliance effects on resource requests and cannot confer the Azure RBAC permission to create role assignments. Turning enforcement off would weaken governance while leaving the recovery administrator without the needed ARM role. The scenario specifically requires recovering an Azure access-management assignment, which is addressed by temporary Global Administrator elevation to User Access Administrator at root scope.

Azure RBAC inheritance is evaluated through the resource’s present scope, not embedded as a durable permission on each item. The helpdesk’s Reader role was assigned to RG-Blue, so moving the resource to RG-Green changes the inherited authorization path. The old group’s assignment does not automatically migrate to the new group or become a direct resource assignment.

Contributor includes resource management actions and is broader than Reader. Azure does not silently elevate users or grant Contributor on RG-Green to preserve access after a resource move. The helpdesk currently has a Reader assignment only at RG-Blue, so operators must examine actual effective roles at the new resource scope rather than assume migration creates a new role assignment.

A role assigned directly to a resource has a different scope from a role inherited from its previous resource group. The fact that RG-Blue no longer grants Reader does not establish that every direct assignment is invalid or should be deleted. Removing all direct assignments could eliminate legitimate access; evaluate the moved resource’s effective grants individually.

Re-creating an Azure RBAC assignment to the same group does not refresh the engineer’s existing Entra authentication context. The resource-group role is already assigned; the newly added member may still be using older group claims or cached effective access. Ask for a fresh sign-in or token and allow for membership/authorization propagation before making a redundant permission change.

Azure RBAC supports group principals. The reported timing points to membership freshness rather than a fundamental unsupported assignment.

Global Administrator is a separate, far broader directory role and is not required merely to inherit an Azure resource-group Contributor role.