Question 4 of 10Manage Azure Identities and Governance
CramHQ's payments team needs one repeatable permission set for operators who manage app resources in selected resource groups across two Azure subscriptions. New app resource groups will be added often, but the permission set must not be available for assignments outside those two subscriptions. Which recommendation best fits?
- AA. Create one Azure custom role with the required Actions, set AssignableScopes to the current resource group IDs, and update the role whenever new app resource groups are created.
- BB. Create one Azure custom role with the required Actions, set AssignableScopes to both subscription IDs, and create role assignments only on the selected resource groups.
- CC. Create separate Azure custom roles with the same required Actions for each resource group, each with AssignableScopes set to that resource group ID.
- DD. Create one Azure custom role with the required Actions, set AssignableScopes to the tenant root management group, and assign it only to the selected resource groups.
Show answer and explanation
Answer: B
A custom role can be made available at subscription scope and then assigned at lower scopes within those subscriptions. This supports new resource groups without changing the role definition while preventing assignments elsewhere.
If you picked AWhy it is tempting: It looks least-privileged because the custom role is available only at the resource groups that need it today.
Why it is wrong: Use AssignableScopes to define the approved area where the custom role can be assigned, and use role assignments to grant access at selected lower scopes.
If you picked CWhy it is tempting: Each role is tightly scoped to one resource group, so it appears to minimize where the role can be assigned.
Why it is wrong: When the Actions are the same, reuse one custom role definition and choose AssignableScopes that cover the approved parent scopes.
If you picked DWhy it is tempting: Assigning the role only to selected resource groups sounds like it keeps actual access narrow.
Why it is wrong: AssignableScopes must stop at the largest approved boundary; narrow assignments do not fix an overly broad role-definition availability scope.
Question 5 of 10Manage Azure Identities and Governance
CramHQ's R&D lab creates and removes simulator VMs weekly in resource group RG-Sim. Automation engineers must start, stop, redeploy, and resize those VMs without managing networking, storage accounts, or any resources in other lab resource groups. Which Azure RBAC recommendation best meets the operational need with the smallest ongoing access boundary?
- AA. Assign Contributor to the automation group at RG-Sim.
- BB. Assign Virtual Machine Contributor to the automation group at each existing simulator VM.
- CC. Assign Virtual Machine Contributor to the automation group at RG-Sim.
- DD. Assign Virtual Machine Contributor to the automation group at the lab subscription.
Show answer and explanation
Answer: C
Virtual Machine Contributor supports the required VM operations. Applying it at RG-Sim covers current and future simulator VMs in that resource group without granting rights in other lab resource groups.
If you picked AWhy it is tempting: Resource group scope looks narrow enough, and Contributor is often associated with day-to-day administration.
Why it is wrong: Select the built-in role that grants the required operations without unnecessary control over unrelated resource types.
If you picked BWhy it is tempting: Per-resource assignment feels like the smallest possible scope for least privilege.
Why it is wrong: Assign at the lowest scope that still covers current resources and expected future resources created under the same boundary.
If you picked DWhy it is tempting: Subscription scope would cover future VMs without repeated assignments.
Why it is wrong: Do not assign at a higher scope when a lower scope covers the operational boundary.
Question 6 of 10Manage Azure Identities and Governance
A researcher at CramHQ can restart virtual machines in the genomics compute resource group. The resource group owner sees no assignment created directly for that researcher and needs to determine why access exists and reduce it without affecting unrelated users. Which recommendation is best?
- AA. Use Access control (IAM) on the resource group to check the researcher, then remove the parent-scope role assignment or replace it with a narrower assignment.
- BB. Use Access control (IAM) on each virtual machine to check the researcher, then remove matching assignments only from the virtual machines.
- CC. Use Access control (IAM) on the resource group to list direct assignments, then add Reader for the researcher at the same resource group.
- DD. Use Microsoft Entra admin center to remove the researcher from all security groups, then recreate only resource-group-level membership.
Show answer and explanation
Answer: A
Checking access at the affected scope shows assignments at that scope and assignments inherited from parent scopes. If the permission comes from a broader assignment, changing that source is required.
If you picked BWhy it is tempting: The observed action happens on virtual machines, so checking each VM feels directly tied to the symptom.
Why it is wrong: For inherited Azure RBAC access, the effective grant can come from the resource group, subscription, or management group; removing only child-resource assignments does not remove parent-scope access.
If you picked CWhy it is tempting: Reader sounds more restrictive, and assigning it at the resource group seems aligned to the affected scope.
Why it is wrong: Azure RBAC role assignments are additive; to reduce access, remove or narrow the assignment that grants the unwanted permission.
If you picked DWhy it is tempting: Security groups can be used in Azure RBAC assignments, so group membership can look like the right place to act.
Why it is wrong: Effective access troubleshooting should identify whether the grant comes from a user assignment, group assignment, role capability, and scope before changing membership or assignments.
Question 7 of 10Manage Azure Identities and Governance
CramHQ's genomics teams frequently deploy short-lived compute resources. Operations finds many resources missing the required billing tag, and some contain stale values. They want future create and update requests to be corrected when possible, and existing resources corrected during a planned cleanup window without making researchers resubmit deployments. Which recommendation best meets the governance intent?
- AA. Assign an Azure Policy definition with the modify effect for the tag and create a remediation task using the assignment's managed identity.
- BB. Assign an Azure Policy definition with the append effect for the tag and run a remediation task after the assignment.
- CC. Assign an Azure Policy definition with the deployIfNotExists effect to deploy the required tag and create a remediation task for existing resources.
- DD. Assign an Azure Policy definition with the deny effect for missing or incorrect tag values and exempt the existing research resource groups temporarily.
Show answer and explanation
Answer: A
This matches the need to correct supported fields during create or update and remediate existing noncompliant resources through a remediation task that uses the assignment identity.
If you picked BWhy it is tempting: Append can sound appropriate when the problem is a missing tag on future deployments.
Why it is wrong: Use modify, not append, when the policy must update supported tag values and remediate resources that already exist.
If you picked CWhy it is tempting: deployIfNotExists is remediation-capable, so it can look close when the question mentions existing resources.
Why it is wrong: Use deployIfNotExists for deploying related resources or configurations, and use modify for changing supported properties such as tags on the evaluated resource.
If you picked DWhy it is tempting: Deny is familiar for preventing noncompliant creates or updates, and exemptions can appear to handle existing resources.
Why it is wrong: Use deny when the intent is to reject noncompliant requests; use modify when the intent is to correct supported properties during evaluation.
Question 8 of 10Manage Azure Identities and Governance
CramHQ's telemetry platform team is onboarding several Azure subscriptions under one management group for mission workloads. Security wants a reusable control package that applies multiple guardrails and configuration checks together, reports compliance as one program, and lets each guardrail keep its own behavior when resources are created or drift. Which recommendation best fits this governance need?
- AA. Create an Azure Policy initiative definition, add the required policy definitions with their own parameters/effects, assign it to the management group with a managed identity, and remediate applicable noncompliant resources.
- BB. Create one custom Azure Policy definition that combines all required checks, assign it to the management group with a managed identity, and use a parameterized deny/audit effect.
- CC. Create an Azure Policy initiative definition, assign it to each resource group with Enforcement mode Disabled, and remediate after compliance scans identify noncompliant resources.
- DD. Create separate Azure Policy assignments for each required policy definition at each subscription, configure the intended effect per assignment, and remediate applicable noncompliant resources.
Show answer and explanation
Answer: A
This preserves each included definition's documented behavior while managing the set through one assignment at the containing scope. The assignment identity supports remediation for definitions that can change existing resources.
If you picked BWhy it is tempting: A custom policy can contain complex logic and can be assigned at the management group, so it appears to centralize governance.
Why it is wrong: When controls need separate evaluation, reporting, parameters, effects, or remediation behavior, group separate definitions in an initiative instead of flattening them into one definition.
If you picked CWhy it is tempting: The choice uses an initiative and still produces compliance data, which matches part of the scenario.
Why it is wrong: The assignment behavior must match the governance intent; disabling enforcement is inappropriate when request-time guardrails and normal policy behavior are required.
If you picked DWhy it is tempting: Separate assignments can enforce each policy and can use the intended effect for each control.
Why it is wrong: Use an initiative when related policy definitions must be assigned and reported together as one managed set.
Question 9 of 10Manage Azure Identities and Governance
CramHQ runs many short-lived genomics experiments in one funded Azure subscription. Each experiment deploys compute, disks, load balancers, and temporary storage in multiple regions, while shared datasets and hub networking must persist. Lab leads need delegated control to clean up only their experiment after publication. Which organization should you recommend?
- AA. Create one resource group per Azure region, place each experiment's regional assets in the matching group, and assign each lab lead Owner on all groups used by that experiment.
- BB. Create one resource group per experiment for temporary assets, keep shared datasets and hub networking in separate resource groups, and assign each lab lead Owner on the experiment group.
- CC. Create one subscription per experiment under the same management group, place shared datasets in a separate subscription, and assign each lab lead Owner on the experiment subscription.
- DD. Create one resource group per resource type, place compute, disks, load balancers, and storage in separate groups, and assign each lab lead Owner on the required type groups.
Show answer and explanation
Answer: B
A resource group is the documented management boundary for resources that are administered together. This matches the experiment lifecycle and permits scoped delegated control without including persistent shared resources.
If you picked AWhy it is tempting: Regional grouping can look tidy when resources are deployed in multiple Azure regions.
Why it is wrong: Resource groups should reflect resources that are administered, delegated, and deleted together when lifecycle is the decisive requirement.
If you picked CWhy it is tempting: A subscription can provide strong isolation, quotas, and billing separation, so it can look like the safest boundary.
Why it is wrong: Select the smallest Azure governance scope that satisfies the control requirement; use a subscription when subscription-level isolation, billing, or policy separation is required.
If you picked DWhy it is tempting: Grouping all compute, disks, load balancers, and storage by type can make inventory views feel orderly.
Why it is wrong: Operational grouping should follow the administration and lifecycle boundary when delegation and cleanup are the stated goals.
Question 10 of 10Manage Azure Identities and Governance
CramHQ removed Lina's Contributor assignment from rg-compute after her project ended, but she can still start and deallocate VMs there. She must keep read-only access to rg-compute, and the ops group she belongs to must continue managing the rest of the subscription. Check access at rg-compute shows the permission source is an ops group assignment above the resource group. What should you recommend?
- AA. Create an Azure deny assignment on rg-compute for VM start and deallocate actions, and assign Lina Reader on rg-compute.
- BB. Remove Lina's direct Contributor assignment on rg-compute and assign Lina Reader on rg-compute.
- CC. Assign Lina Reader on rg-compute and leave the ops group's subscription-level Virtual Machine Contributor assignment unchanged.
- DD. Replace the ops group's subscription-level Virtual Machine Contributor assignment with resource-group assignments for the groups it should manage, and assign Lina Reader on rg-compute.
Show answer and explanation
Answer: D
This changes the assignment that still grants VM management at the broader boundary while preserving the group's management access where it is still needed. The Reader assignment supplies only the stated read-only access.
If you picked AWhy it is tempting: A deny sounds like it would override allowed actions while preserving read access.
Why it is wrong: Use the effective permission source shown by Check access to decide which role assignment must change.
If you picked BWhy it is tempting: Contributor on the affected resource group is the obvious permission to remove when VM management should stop there.
Why it is wrong: Distinguish direct assignments from inherited assignments; removing one does not affect permissions granted from a parent scope.
If you picked CWhy it is tempting: Reader matches Lina's required remaining access, so it can look like the final corrective assignment.
Why it is wrong: Azure RBAC allow permissions are additive; a narrower read-only assignment does not remove actions granted by another role assignment.
