AZ104 FINAL PAPER FULL QUESTIONS
AND CORRECT ANSWERS VERIFIED
●● "You have an Azure subscription.
From PowerShell, you run the Get-MgUser cmdlet for a user and receive
the following details:
Id: 8755b347-3545-3876-3987-999999999999
DisplayName: Ben Smith
Mail:
UserPrincipalName: bsmith_contoso.com#EXT#@fabrikam.com
Which statement accurately describes the user?
Answer: For guest users, the user principal name (UPN) will contain the
email of the guest user (bsmith_contoso.com) followed by #EXT#
followed by the domain name of the tenant (@fabrikam.com). Regular
Microsoft Entra users appear in a format of .
●● "Your Microsoft Entra tenant and on-premises Active Directory
domain contain multiple users.
You need to configure self-service password reset (SSPR) password
writeback functionality. The solution must minimize costs.
,Which Microsoft Entra ID edition should you use?
Answer: Only Microsoft Entra ID P1 and P2 support SSPR, but
Microsoft Entra ID P1 is the lower cost option.
●● "You have an Azure subscription that contains multiple virtual
machines.
You need to ensure that a user named User1 can view all the resources in
a resource group named RG1. You must use the principle of least
privilege.
Which role should you assign to User1?
Answer: The Reader role allows you to view all the resources but does
not allow you to make any changes. The Contributor role allows you to
manage all the resources, the Billing Reader role provides read access
only to billing data, and the Tag Contributor role allows you to manage
entity tags without providing access to the entities themselves.
●● "You have an Azure subscription that contains several storage
accounts.
You need to provide a user with the ability to perform the following
tasks:
,Manage containers within the storage accounts.
View storage account access keys.
The solution must use the principle of least privilege.
Which role should you assign to the user?
Answer: Storage Account Contributor allows the management of storage
accounts. It provides access to the account key, which can be used to
access data via Shared Key authorization. Storage Blob Data Contributor
grants permissions to read, write, and delete Azure Storage containers
and blobs. Reader allows you to view all resources but does not allow
you to make any changes. Owner grants full access to manage all
resources, including the ability to assign roles in Azure RBAC.
●● "You have an Azure subscription and a user named User1.
You need to assign User1 a role that allows the user to create and
manage all types of resources in the subscription. The solution must
prevent User1 from assigning roles to other users.
Which Azure role-based access control (RBAC) role should you assign
to User1?
Answer: Users with the Contributor role can create and manage all types
of resources but cannot delegate new access to other users. Users with
the Reader role can view existing Azure resources but cannot perform
any action against them. Users with the API Management Service
Contributor role can only manage API Management services and APIs.
, Users with the Owner role provides full access to all resources,
including the right to delegate access to others.
●● "You have an Azure subscription that contains 25 virtual machines.
You need to ensure that each virtual machine is associated to a specific
department for reporting purposes.
What should you use?
Answer: Tags are metadata elements that can be applied to Azure
resources. Tags can be used for tracking resources such as virtual
machines and associating each resource to a department for billing and
reporting purposes.
Administrative units are containers used for delegating administrative
roles to manage a specific portion of Microsoft Entra. Administrative
units cannot contain Azure virtual machines.
Management groups are containers that can be used to manage access,
policy, and compliance across multiple Azure subscriptions.
Azure Storage accounts contain Azure Storage data objects, including
blobs, file shares, queues, tables, and disks. A storage account cannot
contain virtual machines.
AND CORRECT ANSWERS VERIFIED
●● "You have an Azure subscription.
From PowerShell, you run the Get-MgUser cmdlet for a user and receive
the following details:
Id: 8755b347-3545-3876-3987-999999999999
DisplayName: Ben Smith
Mail:
UserPrincipalName: bsmith_contoso.com#EXT#@fabrikam.com
Which statement accurately describes the user?
Answer: For guest users, the user principal name (UPN) will contain the
email of the guest user (bsmith_contoso.com) followed by #EXT#
followed by the domain name of the tenant (@fabrikam.com). Regular
Microsoft Entra users appear in a format of .
●● "Your Microsoft Entra tenant and on-premises Active Directory
domain contain multiple users.
You need to configure self-service password reset (SSPR) password
writeback functionality. The solution must minimize costs.
,Which Microsoft Entra ID edition should you use?
Answer: Only Microsoft Entra ID P1 and P2 support SSPR, but
Microsoft Entra ID P1 is the lower cost option.
●● "You have an Azure subscription that contains multiple virtual
machines.
You need to ensure that a user named User1 can view all the resources in
a resource group named RG1. You must use the principle of least
privilege.
Which role should you assign to User1?
Answer: The Reader role allows you to view all the resources but does
not allow you to make any changes. The Contributor role allows you to
manage all the resources, the Billing Reader role provides read access
only to billing data, and the Tag Contributor role allows you to manage
entity tags without providing access to the entities themselves.
●● "You have an Azure subscription that contains several storage
accounts.
You need to provide a user with the ability to perform the following
tasks:
,Manage containers within the storage accounts.
View storage account access keys.
The solution must use the principle of least privilege.
Which role should you assign to the user?
Answer: Storage Account Contributor allows the management of storage
accounts. It provides access to the account key, which can be used to
access data via Shared Key authorization. Storage Blob Data Contributor
grants permissions to read, write, and delete Azure Storage containers
and blobs. Reader allows you to view all resources but does not allow
you to make any changes. Owner grants full access to manage all
resources, including the ability to assign roles in Azure RBAC.
●● "You have an Azure subscription and a user named User1.
You need to assign User1 a role that allows the user to create and
manage all types of resources in the subscription. The solution must
prevent User1 from assigning roles to other users.
Which Azure role-based access control (RBAC) role should you assign
to User1?
Answer: Users with the Contributor role can create and manage all types
of resources but cannot delegate new access to other users. Users with
the Reader role can view existing Azure resources but cannot perform
any action against them. Users with the API Management Service
Contributor role can only manage API Management services and APIs.
, Users with the Owner role provides full access to all resources,
including the right to delegate access to others.
●● "You have an Azure subscription that contains 25 virtual machines.
You need to ensure that each virtual machine is associated to a specific
department for reporting purposes.
What should you use?
Answer: Tags are metadata elements that can be applied to Azure
resources. Tags can be used for tracking resources such as virtual
machines and associating each resource to a department for billing and
reporting purposes.
Administrative units are containers used for delegating administrative
roles to manage a specific portion of Microsoft Entra. Administrative
units cannot contain Azure virtual machines.
Management groups are containers that can be used to manage access,
policy, and compliance across multiple Azure subscriptions.
Azure Storage accounts contain Azure Storage data objects, including
blobs, file shares, queues, tables, and disks. A storage account cannot
contain virtual machines.
