Microsoft Certified: Azure Administrator Associate - (AZ-104) Exam Questions

Assign the Website Contributor role is the correct answer here. The Website Contributor role provides the necessary permissions to manage the web app, including deploying content, without giving the developers excessive privileges such as those granted by the Owner role. This ensures the solution follows the principle of least privilege.

Assign the Owner role to the developers is incorrect because the Owner role gives full control over the resource, including the ability to delete or modify access permissions, which violates the principle of least privilege.

Configure app-level credentials for FTPS is incorrect  because using app-level credentials does not involve using Microsoft Entra credentials and does not follow the principle of least privilege.

Configure user-level credentials for FTPS is incorrect  because this does not involve using Microsoft Entra credentials and provides too much access for just deploying content.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#website-contributor

No is correct because User1 is assigned the Storage Blob Data Reader role at the Sub1 scope with Condition1, which restricts access to the blobs unless certain conditions are met. Condition1 specifies that User1 can only read blobs within containers named cont1. Since blob2 is in container cont2, User1 cannot read it due to the condition restricting access to containers named cont1.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-overview

• https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-format

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Yes is correct because, based on the conditions set in Condition1, User1 is restricted from reading any blob outside of the cont1 container. Although blob3 is in a different container (cont1 in storage2), the condition will allow User1 to access it. The condition in Condition1 only allows User1 to read blobs from the cont1 container in any storage account in that subscription.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-format

Yes is correct because User2 is assigned the "Storage Blob Data Owner" role at the scope of storage1, which contains blob1. The role of Storage Blob Data Owner provides full read and write permissions over all blobs within the assigned storage account unless restricted by conditions.

In this case, Condition2 only applies to write operations with paths matching *2*. Since User2 is performing a read operation and not a write, the condition does not apply. Therefore, User2 retains the default read permissions granted by the Storage Blob Data Owner role and can read blob1.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-format

No is correct because the contoso.com zone is a public DNS zone, not a private DNS zone. Auto registration for DNS records is supported only for private DNS zones when linked to virtual networks. Since contoso.com is a public DNS zone and auto registration is not enabled for public zones, a DNS A record for vm1 will not be automatically added with its public IP address of 131.107.50.20.

Additionally, the assignment of the Owner role to vm1 and vm2 does not influence DNS auto registration, as that pertains to role-based access control (RBAC) and not DNS management.

Reference(s):

• https://learn.microsoft.com/en-us/azure/dns/private-dns-autoregistration

Yes is correct because fabrikam.com is a private DNS zone, and since auto-registration is enabled for vnet1, the private IP address (10.0.1.4) of vm1 will be automatically added as an A record to the fabrikam.com private DNS zone. Auto-registration is supported for private DNS zones, and linking the virtual network ensures that virtual machines connected to the network can have their private IP addresses automatically registered in the private DNS zone.

Reference(s):

• https://learn.microsoft.com/en-us/azure/dns/private-dns-autoregistration

Yes is correct because fabrikam.com is a private DNS zone, and auto-registration is enabled for vnet1, which is the virtual network that vm2 is connected to. This means that the private IP address (10.0.1.5) of vm2 will be automatically added as an A record to the fabrikam.com private DNS zone.

Reference(s):

• https://learn.microsoft.com/en-us/azure/dns/private-dns-autoregistration

No is correct because User1 does not have the "Virtual Machine User Login" role assigned for VM1 or at the scope of Sub1. While User1 has the "Virtual Machine Contributor" role for management group MG1, which includes Sub1, the "Virtual Machine Contributor" role alone does not grant login permissions. The "Virtual Machine User Login" role is required to allow the user to sign in to the virtual machine, and this role is not assigned to User1 for VM1, Sub1, or RG1.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

No is correct because User2 has the "Virtual Machine Contributor" role assigned to management group MG2, which includes Sub2, but VM1 is located in Sub1. Therefore, User2 does not have the necessary permissions to manage the disks or disk snapshots for VM1. The "Virtual Machine Contributor" role assigned at MG2 does not apply to resources in Sub1, including VM1. As a result, User2 cannot manage disks or snapshots of VM1.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

No is correct because the "Virtual Machine Contributor" role allows users to manage virtual machines and attached disks but does not grant permissions to manage disk snapshots. Managing disk snapshots requires specific permissions, such as those granted by the "Disk Snapshot Contributor" role. Since User2 only has the "Virtual Machine Contributor" role, they can manage disks but cannot manage snapshots for VM3.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles