AZ-104 Manage Azure Identities and Governance Practice Questions

Free AZ-104 Manage Azure Identities and Governance practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AZ-104 page. Sign up free to practice the full set.

1. Question 1Manage Azure Identities and Governance

   A user reports they cannot reset their password using self-service password reset (SSPR). SSPR is enabled for a group called SSPR-Enabled. The user is a member of the All Users group but not the SSPR-Enabled group. What is the most likely cause?

   • AThe user is not a member of the SSPR-Enabled groupCorrect
   • BThe user's account is disabled
   • CThe user has not registered authentication methods
   • DSSPR requires Microsoft Entra ID P2
   ✓ Correct answer: A

   When self-service password reset is configured for a specific group, only members of that selected group can use SSPR. The user must be directly added to the SSPR-Enabled group to gain access to the password reset functionality. Being a member of the All Users group has no effect unless SSPR is configured for all users in the tenant.

   Why the other options are wrong

   • BA disabled account would prevent sign-in entirely, but the question specifically states the user cannot use SSPR, not that they cannot sign in at all.
   • CNot having registered authentication methods would produce a different error message prompting the user to register, rather than being blocked from SSPR entirely.
   • DSSPR requires Microsoft Entra ID P1 for non-admin users, not P2, so the licensing tier is not the issue here.
2. Question 2Manage Azure Identities and GovernanceSelect all that apply

   You are configuring role-based access control (RBAC) for a new Azure subscription. Which of the following statements about Azure RBAC are correct? (Choose two.)

   • ARBAC role assignments are inherited from parent scopes to child scopes.Correct
   • BDeny assignments can be created directly by any user who holds the Owner role.
   • CThe Owner role includes the ability to assign roles to other users via Azure RBAC.Correct
   • DCustom RBAC roles can only be assigned at the subscription scope.
   ✓ Correct answer: A, C

   Azure RBAC uses a hierarchical scope model where role assignments at a parent scope (such as a management group or subscription) are automatically inherited by all child scopes beneath it. This means a role assigned at the subscription level applies to all resource groups and resources within that subscription. The Owner built-in role includes the Microsoft.Authorization/roleAssignments/write permission, which grants the ability to create role assignments for other users, in addition to full resource management capabilities.

   Why the other options are wrong

   • BDeny assignments do take precedence over role assignments, but they are currently created only by Azure Blueprints and cannot be directly created by users, making the absolute statement that they always take precedence misleading in practical terms.
   • DCustom RBAC roles can be assigned at multiple scopes including management groups, subscriptions, resource groups, and individual resources, so the claim that they can only be assigned at the subscription scope is incorrect.
3. Question 3Manage Azure Identities and Governance

   You manage an Azure subscription for Woodgrove Bank. You need to ensure that a specific resource group named FinancialData-RG cannot be deleted, but resources within it can still be modified. What should you configure?

   • AAn Azure Policy with the Deny effect
   • BRemove the Contributor role from all users on the resource group
   • CA ReadOnly lock on the resource group
   • DA Delete lock on the resource groupCorrect
   ✓ Correct answer: D

   Azure resource locks provide a mechanism to protect resources from accidental operations. A Delete lock, also known as CanNotDelete, prevents the resource group and its contents from being deleted while still allowing all other operations such as creating, modifying, and updating resources within it. This is the simplest and most direct way to protect a resource group from deletion without restricting day-to-day resource management activities. The lock applies regardless of the user's RBAC permissions.

   Why the other options are wrong

   • AAn Azure Policy with the Deny effect could potentially achieve a similar result but would require crafting a custom policy definition and is a more complex approach for this specific requirement.
   • BRemoving the Contributor role from all users on the resource group would prevent resource modifications as well as deletion, which violates the requirement that resources within it should still be modifiable.
   • CA ReadOnly lock would prevent any modifications to the resource group and all resources within it, which contradicts the requirement that resources should still be modifiable.
4. Question 4Manage Azure Identities and Governance

   Tailspin Toys needs to ensure that guest users invited to their Microsoft Entra ID tenant can only access specific applications. They want to automatically remove guest access after 90 days unless the access is re-approved. Which feature should they implement?

   • AAzure Policy with tag enforcement
   • BMicrosoft Entra ID dynamic groups
   • CConditional Access with session controls
   • DEntitlement management with access packagesCorrect
   ✓ Correct answer: D

   Entitlement management in Microsoft Entra ID allows organizations to create access packages that bundle together the specific applications, groups, and SharePoint sites that external guest users can access. Access packages support expiration policies, so you can configure guest access to automatically expire after 90 days. When access expires, the guest user must request re-approval to regain access, ensuring that stale guest accounts do not retain access indefinitely. This provides a complete lifecycle management solution for external identities, from initial invitation through access expiration and renewal.

   Why the other options are wrong

   • AAzure Policy with tag enforcement is used for managing and governing Azure resource deployments and has no capability to manage guest user application access.
   • BMicrosoft Entra ID dynamic groups automatically manage group membership based on user attributes but do not provide expiration policies or approval workflows for guest access.
   • CConditional Access with session controls can enforce restrictions during active sessions but does not manage the lifecycle of guest user access or automatically remove access after a defined period.
5. Question 5Manage Azure Identities and Governance

   Which tool provides recommendations to improve Azure security, cost, and performance?

   • AAzure AdvisorCorrect
   • BAzure Blueprints
   • CAzure Monitor
   • DAzure Policy
   ✓ Correct answer: A

   Azure Advisor is a personalized cloud consultant that analyzes your Azure resource configurations and usage telemetry to provide actionable recommendations across five categories: cost, security, reliability, operational excellence, and performance. It continuously evaluates your deployed resources and suggests optimizations such as right-sizing virtual machines, enabling security features, or improving application resiliency. Advisor provides a unified view of best-practice recommendations tailored to your specific environment.

   Why the other options are wrong

   • BAzure Blueprints is a service for defining repeatable sets of Azure resources and policies for consistent environment deployment, not for providing optimization recommendations.
   • CAzure Monitor collects, analyzes, and acts on telemetry data from Azure and on-premises environments, focusing on observability rather than optimization recommendations.
   • DAzure Policy evaluates resources for compliance with organizational rules and can enforce or audit configurations, but it does not provide improvement recommendations across cost, security, and performance.
6. Question 6Manage Azure Identities and Governance

   An Azure subscription can be associated with multiple Microsoft Entra ID tenants at the same time.

   • ATrue
   • BFalseCorrect
   ✓ Correct answer: B

   The correct answer is False. An Azure subscription can only be associated with a single Microsoft Entra ID tenant at any given time. This is a one-to-one relationship from the subscription's perspective. The Microsoft Entra ID tenant serves as the identity provider for the subscription, and all role-based access control (RBAC) assignments for that subscription reference identities from that single tenant. While you can change (transfer) a subscription's tenant association to a different Microsoft Entra ID tenant, this is a discrete operation that replaces the association rather than adding a second one. Conversely, a single Microsoft Entra ID tenant can have multiple subscriptions associated with it, establishing a one-to-many relationship from the tenant's perspective. This behavior is documented in Microsoft Azure documentation for the AZ-104 exam.

   Why the other options are wrong

   • ATrue is incorrect. The statement is false: The correct answer is False. An Azure subscription can only be associated with a single Microsoft Entra ID tenant at any given time. This is a one-to-one relationship from the subscription's perspective.
7. Question 7Manage Azure Identities and Governance

   You have the Microsoft Entra ID groups shown in the table. User3 is a guest user whose department attribute is set to Engineering. Which groups will User3 be a member of?

   • AGRP-Developers and GRP-Contractors onlyCorrect
   • BGRP-Contractors only
   • CGRP-Developers only
   • DGRP-Developers, GRP-Contractors, and GRP-All
   ✓ Correct answer: A

   User3 is a guest user with the department attribute set to Engineering. Dynamic group membership rules are evaluated independently for each user. GRP-Developers has the dynamic rule department eq 'Engineering', so User3 matches this rule and is automatically added as a member. GRP-Contractors has the dynamic rule userType eq 'Guest', and since User3 is a guest user, this rule also matches and User3 is automatically added.

   Why the other options are wrong

   • BGRP-Contractors only is incorrect because User3 also matches the GRP-Developers dynamic rule through the Engineering department attribute.
   • CGRP-Developers only is incorrect because User3 also matches the GRP-Contractors dynamic rule as a guest user.
   • DGRP-Developers, GRP-Contractors, and GRP-All is incorrect because User3 is not a member of GRP-Admins, which is the only nested group in GRP-All.
8. Question 8Manage Azure Identities and Governance

   A new employee named User5 is created with country=US, userType=Member, companyName=Contoso, officeLocation=null, and accountEnabled=true. User5 is also manually added to GRP-Managers. How many groups will User5 be a member of?

   • A2
   • B3
   • C4Correct
   • D1
   ✓ Correct answer: C

   Dynamic group membership is determined by evaluating each group's membership rule against the user's attributes. User5's attributes (country=US, userType=Member, companyName=Contoso, accountEnabled=true) cause the user to match three dynamic groups whose rules align with those values, and the user is also manually added to GRP-Managers. Adding the one manual membership to the three rule-based matches gives a total of four groups. Note that an attribute set to null, such as officeLocation, simply fails any rule that requires a specific value for it. The combined count is therefore 4.

   Why the other options are wrong

   • A2 undercounts the memberships; the user matches three dynamic rules plus the one manual group.
   • B3 counts only the dynamic matches and omits the manual GRP-Managers membership, or vice versa.
   • D1 ignores the dynamic group rule matches the user's attributes satisfy.

How Manage Azure Identities and Governance is tested

This domain holds 225 of the 956 questions in the AZ-104 bank, about 24%. The mix is 127 single-answer multiple choice, 24 true/false, 24 yes/no scenario, 23 multiple-response, 17 hotspot and 10 ordering, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Manage Azure Identities and Governance on its own rather than re-running full-length mocks.

Other AZ-104 exam domains

• Implement and Manage Storage195 questions
• Deploy and Manage Azure Compute Resources200 questions
• Implement and Manage Virtual Networking194 questions
• Monitor and Maintain Azure Resources142 questions
• All AZ-104 practice questions956 total
• Manage Azure Identities and Governance study notesKey concepts
• Microsoft practice examsAll Microsoft

AZ-104 Manage Azure Identities and Governance FAQ