Pass Your Microsoft AZ-104 Exam Easy!

Assigning permissions to a policy managed identity can enable modify or deployIfNotExists remediation operations, but it does not change which resources the assignment evaluates. Contributor is also unnecessarily broad and not a mechanism to exclude a lab from the compliance denominator. The laboratory remains a descendant of the policy assignment until an explicit exclusion or different appropriate scope configuration is applied. The requirement concerns the assignment boundary, not remediation identity privileges. Configure the laboratory as a notScopes excluded subscription while retaining the desired production evaluation scope.

Moving resources between resource groups within the same laboratory subscription does not remove that subscription from a policy assigned above it at the management-group scope. Azure Policy assignment coverage follows the defined hierarchy and exclusions, not an assumption that a new group name signifies nonproduction. With no notScopes entry, applicable laboratory resources can continue to be evaluated and appear in compliance results. To satisfy the stated permanent removal from evaluation, modify the assignment exclusion list or hierarchy deliberately; rearranging resources inside the same covered subscription is insufficient.

Azure Policy exemptions are designed for documented waivers or mitigations and can have an expiry, but exempted resources remain represented as Exempted in compliance reporting. This violates the question’s explicit requirement that the permanent laboratory exception not appear as Exempted or be counted as evaluated. A time-limited exemption would additionally require renewal and approval after expiration. Microsoft recommends broad, permanent bypasses through assignment exclusions using notScopes, reserving exemptions for tracked temporary or specific deviations. Both are valid features generally, but only notScopes meets this precise reporting and duration constraint.

When new resources regularly miss a mandatory billing tag, the action 'Assign a tag inheritance or modify Azure Policy with remediation controls' can be relevant: policy can enforce tagging rules systematically; portal advice alone does not remediate missing tags. For the different problem of several regulatory controls must be tracked and applied together, 'Assign a tag inheritance or modify Azure Policy with remediation controls' misses the mechanism that an initiative combines multiple definitions for consistent assignment and compliance reporting. Choosing 'Assign a tag inheritance or modify Azure Policy with remediation controls' would address that other need, whereas 'Group related policy definitions into an initiative and assign it' is intended to solve the stated condition.

'Grant the policy assignment's managed identity the needed target-scope deployment role' applies to a different feature boundary because compliance detection alone does not grant rights to deploy dependent resources during remediation. In the stated scenario where several regulatory controls must be tracked and applied together, 'Grant the policy assignment's managed identity the needed target-scope deployment role' does not satisfy the mechanism that an initiative combines multiple definitions for consistent assignment and compliance reporting. The necessary action is 'Group related policy definitions into an initiative and assign it', which should be checked against this Azure resource's actual permissions and state.

'Assign at the intended scope with explicit exclusion or documented exemption' solves another task because an appropriate assignment scope prevents policy applying to unrelated environments. For the situation where several regulatory controls must be tracked and applied together, this distractor misses the requirement that an initiative combines multiple definitions for consistent assignment and compliance reporting. Unlike 'Assign at the intended scope with explicit exclusion or documented exemption', 'Group related policy definitions into an initiative and assign it' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a team wants to see policy violations without blocking new deployments, the action 'Assign an audit effect rather than deny' can be relevant: audit records noncompliance but does not automatically reject matching resource requests. For the different problem of several regulatory controls must be tracked and applied together, 'Assign an audit effect rather than deny' misses the mechanism that an initiative combines multiple definitions for consistent assignment and compliance reporting. Choosing 'Assign an audit effect rather than deny' would address that other need, whereas 'Group related policy definitions into an initiative and assign it' is intended to solve the stated condition.

Disabling a shared policy definition or broadly weakening the assignment removes governance from unrelated environments. The request is for a justified time-limited waiver covering one development subscription. Azure Policy exemptions can represent the specific affected scope and expiration while preserving evidence in compliance reporting. The administrator should create the scoped exception, not expose all production subscriptions to a relaxed standard.

'Review compliance result and remediation, not assume enforcement removed the existing resource' solves another task because audit/evaluation flags existing resources; request-time deny is not retrospective deletion. For the situation where a development subscription needs a time-limited exception to one policy standard, this distractor misses the requirement that an exemption preserves governance outside the temporary exception and leaves an audit trail. Unlike 'Review compliance result and remediation, not assume enforcement removed the existing resource', 'Create a justified, scoped, expiring exemption rather than weakening the global definition' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a team wants to see policy violations without blocking new deployments, the action 'Assign an audit effect rather than deny' can be relevant: audit records noncompliance but does not automatically reject matching resource requests. For the different problem of a development subscription needs a time-limited exception to one policy standard, 'Assign an audit effect rather than deny' misses the mechanism that an exemption preserves governance outside the temporary exception and leaves an audit trail. Choosing 'Assign an audit effect rather than deny' would address that other need, whereas 'Create a justified, scoped, expiring exemption rather than weakening the global definition' is intended to solve the stated condition.

A `ReadOnly` management lock also prevents removal of the ARM resource, but unlike `CanNotDelete` it blocks updates and many POST operations. For example, VM start or restart operations can require ARM write-like requests, and ordinary changes to resource configuration are restricted. The stem explicitly requires operators to keep updating VM properties, so `ReadOnly` is too restrictive. Restricting deletions without blocking authorized resource edits calls for the Delete/`CanNotDelete` lock level, not a lock that behaves like a broad control-plane Reader restriction.

An approved maintenance process may temporarily remove a lock when an otherwise forbidden delete or modification is truly necessary. That is a change-management exception rather than the lock type the question asks to choose. Here operators need routine Azure Resource Manager updates while stopping accidental removal of the resource; `CanNotDelete` already permits authorized updates. Unnecessarily removing the lock exposes the resource to deletion during the window, and reinstatement afterwards does not undo an earlier destructive action. Keep the correct lock in place for ordinary updates and reserve exceptional changes for a separate workflow.

Inspecting inherited locks is useful when a deletion fails unexpectedly or an RBAC Owner still receives a denial. Locks take precedence over resource-role permissions, so adding more Owner or Contributor grants does not bypass a management lock. Nevertheless, inspecting locks alone is a diagnostic and does not impose the requested safeguard on a resource that currently has none. The scenario asks the administrator to choose the control that allows ordinary management updates while blocking ARM deletion; the correct mechanism is a `CanNotDelete` lock at the appropriate resource or parent scope.

A lock configured on a resource group or subscription can be inherited by the VM resource, and the most restrictive effective lock governs control-plane operations. Therefore checking the hierarchy is sensible when confirming the final behavior. But the option merely tells the operator to inspect a possible inherited lock; it does not specify or establish the lock type needed. The requirement is to permit authorized configuration updates while denying ARM deletion, so an effective `CanNotDelete` lock is the target state. Remember that neither an inherited nor direct lock secures VM guest files against data-plane deletion.

Contributor normally has management-plane write actions for supported VM updates at an authorized resource scope. Its permissions are not limitless, and they remain subject to deny assignments, policy and resource management locks, but the statement that Contributor can never update a VM is technically wrong. Here the operator's role has already been checked, and the described ReadOnly lock is sufficient to block Azure Resource Manager modifications. Altering RBAC alone would not neutralize that lock. The team should get lock changes approved through its authorized governance process if maintenance is needed.

A CanNotDelete lock blocks resource deletion but generally permits updates when Azure RBAC and other controls authorize them. This case explicitly identifies a ReadOnly lock, which also blocks control-plane write operations such as changing the VM configuration. Substituting a different lock type would change the scenario and protection level; it does not explain the failure currently observed. Administrators should not weaken the lock casually, because protecting the virtual machine from unintended modification may be the reason it exists. Identify the actual effective ReadOnly lock before planning an authorized maintenance exception.

Renewing a Microsoft Entra access token can sometimes resolve stale role-assignment visibility, but management locks are authorization controls enforced by Azure Resource Manager, not an attribute of the user's cached role token. The facts say that Contributor is effective and that a ReadOnly lock exists at the parent resource group. A fresh sign-in therefore does not change the control-plane prohibition. If a permitted update is necessary, an identity authorized to manage locks must first approve and make the appropriate scoped change and then restore protection as policy requires.

The scenario explicitly rules out a lock attached to the storage account itself. Locks can be inherited from a parent resource group or subscription, so an attempted change to a nonexistent child lock will not remove the actual constraint. The correct investigation follows the resource hierarchy to locate an applicable CanNotDelete or ReadOnly lock. Only then can an authorized lock modification be assessed under change control.

The nearby action 'Verify individual resource tag support and configure inheritance explicitly' is associated with this separate need: an engineer assumes a resource group's tag always appears on every child resource. That is because resource group tags are not universally inherited by every child without suitable policy. Here a storage account cannot be deleted and has no lock directly attached, so 'Verify individual resource tag support and configure inheritance explicitly' misses the fact that Azure locks inherit down scope hierarchy and can affect child resource deletion. 'Check inherited lock on its resource group or parent subscription' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Apply a CanNotDelete lock instead of ReadOnly' solves another task because canNotDelete blocks deletion while allowing updates permitted by RBAC. For the situation where a storage account cannot be deleted and has no lock directly attached, this distractor misses the requirement that Azure locks inherit down scope hierarchy and can affect child resource deletion. Unlike 'Apply a CanNotDelete lock instead of ReadOnly', 'Check inherited lock on its resource group or parent subscription' directly targets that requirement; its success must be confirmed at the authorized resource scope.

An Owner role permits broad resource management but does not override an active Azure management lock that prohibits deletion. The premise already says changing Contributor to Owner failed, so another Owner grant would repeat the same approach and expand access unnecessarily. Check effective locks at the resource and ancestor scopes; once a lock is found, any modification should be separately authorized rather than replaced by role escalation.

The nearby action 'Apply a CanNotDelete lock instead of ReadOnly' is associated with this separate need: operators must update a resource but never delete it. That is because canNotDelete blocks deletion while allowing updates permitted by RBAC. Here a blocked delete operation persists after Contributor is replaced with Owner, so 'Apply a CanNotDelete lock instead of ReadOnly' misses the fact that owner does not override an active CanNotDelete lock for ordinary delete requests. 'Inspect resource locks before increasing RBAC privileges further' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Review and securely manage the ReadOnly resource lock' solves another task because readOnly blocks write changes even when a user's RBAC grant otherwise permits them. For the situation where a blocked delete operation persists after Contributor is replaced with Owner, this distractor misses the requirement that owner does not override an active CanNotDelete lock for ordinary delete requests. Unlike 'Review and securely manage the ReadOnly resource lock', 'Inspect resource locks before increasing RBAC privileges further' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Check inherited lock on its resource group or parent subscription' solves another task because Azure locks inherit down scope hierarchy and can affect child resource deletion. For the situation where a maintenance window requires temporarily changing a resource lock, this distractor misses the requirement that lock changes are high-impact governance actions and should be time-bound and auditable. Unlike 'Check inherited lock on its resource group or parent subscription', 'Authorize the lock change, record it, perform maintenance, and reinstate protection' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When operators must update a resource but never delete it, the action 'Apply a CanNotDelete lock instead of ReadOnly' can be relevant: canNotDelete blocks deletion while allowing updates permitted by RBAC. For the different problem of a maintenance window requires temporarily changing a resource lock, 'Apply a CanNotDelete lock instead of ReadOnly' misses the mechanism that lock changes are high-impact governance actions and should be time-bound and auditable. Choosing 'Apply a CanNotDelete lock instead of ReadOnly' would address that other need, whereas 'Authorize the lock change, record it, perform maintenance, and reinstate protection' is intended to solve the stated condition.

'Review and securely manage the ReadOnly resource lock' applies to a different feature boundary because readOnly blocks write changes even when a user's RBAC grant otherwise permits them. In the stated scenario where a maintenance window requires temporarily changing a resource lock, 'Review and securely manage the ReadOnly resource lock' does not satisfy the mechanism that lock changes are high-impact governance actions and should be time-bound and auditable. The necessary action is 'Authorize the lock change, record it, perform maintenance, and reinstate protection', which should be checked against this Azure resource's actual permissions and state.

When a cost center changes its Azure tags and claims that grants to the resource also changed, the action 'Treat tag metadata separately from Azure RBAC permission assignments' can be relevant: tags are classification metadata unless explicit conditional access logic references them. For the different problem of new resources regularly miss a mandatory billing tag, 'Treat tag metadata separately from Azure RBAC permission assignments' misses the mechanism that policy can enforce tagging rules systematically; portal advice alone does not remediate missing tags. Choosing 'Treat tag metadata separately from Azure RBAC permission assignments' would address that other need, whereas 'Assign a tag inheritance or modify Azure Policy with remediation controls' is intended to solve the stated condition.

The Audit effect can detect resources lacking a required tag and report noncompliance, but by itself it does not modify resource properties. The situation calls for automatically governing and correcting missing billing tags. Depending on supported resource properties, a properly scoped modify policy and remediation identity can add tags. A detector-only policy without remediation leaves resource tagging unchanged despite showing a compliance result.

The nearby action 'Use a controlled, nonsensitive cost-center taxonomy for resources' is associated with this separate need: teams share a tenant and need reliable chargeback without exposing customer names in tags. That is because consistent tags support grouping while avoiding protected identifiers in broad metadata. Here new resources regularly miss a mandatory billing tag, so 'Use a controlled, nonsensitive cost-center taxonomy for resources' misses the fact that policy can enforce tagging rules systematically; portal advice alone does not remediate missing tags. 'Assign a tag inheritance or modify Azure Policy with remediation controls' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Azure resource groups have their own tag metadata, and newly created child resources do not universally receive the parent group's cost-center tag automatically. This option explicitly skips the Azure Policy or deployment mechanism that would make inheritance effective. The scenario identifies a recurring missing-tag problem, so relying on passive inheritance preserves the exact source of inaccurate chargeback reporting. Use a supported tag-inheritance or Modify policy assignment with appropriate remediation for existing resources, then inspect tags on actual child resources to confirm the cost-center field is present. Tag policy is separate from Azure RBAC grants.

When an engineer assumes a resource group's tag always appears on every child resource, the action 'Verify individual resource tag support and configure inheritance explicitly' can be relevant: resource group tags are not universally inherited by every child without suitable policy. For the different problem of a cost center changes its Azure tags and claims that grants to the resource also changed, 'Verify individual resource tag support and configure inheritance explicitly' misses the mechanism that tags are classification metadata unless explicit conditional access logic references them. Choosing 'Verify individual resource tag support and configure inheritance explicitly' would address that other need, whereas 'Treat tag metadata separately from Azure RBAC permission assignments' is intended to solve the stated condition.

'Use a controlled, nonsensitive cost-center taxonomy for resources' applies to a different feature boundary because consistent tags support grouping while avoiding protected identifiers in broad metadata. In the stated scenario where a cost center changes its Azure tags and claims that grants to the resource also changed, 'Use a controlled, nonsensitive cost-center taxonomy for resources' does not satisfy the mechanism that tags are classification metadata unless explicit conditional access logic references them. The necessary action is 'Treat tag metadata separately from Azure RBAC permission assignments', which should be checked against this Azure resource's actual permissions and state.

'Filter by consistent cost-center tags and verified subscription/resource scopes' solves another task because tag coverage and cost period must be checked, because missing or late-applied tags can skew attribution. For the situation where a cost center changes its Azure tags and claims that grants to the resource also changed, this distractor misses the requirement that tags are classification metadata unless explicit conditional access logic references them. Unlike 'Filter by consistent cost-center tags and verified subscription/resource scopes', 'Treat tag metadata separately from Azure RBAC permission assignments' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Treat a budget alert as a notification, not an automatic shutdown mechanism' applies to a different feature boundary because budget notifications report thresholds but do not natively stop resource usage without separate automation. In the stated scenario where a finance team adds project tags today and expects yesterday's historical usage to be fully reclassified, 'Treat a budget alert as a notification, not an automatic shutdown mechanism' does not satisfy the mechanism that cost attribution depends on ingestion period and tagging at usage time; verify report behavior. The necessary action is 'Tag changes do not automatically rewrite all historical usage attribution', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Assign a tag inheritance or modify Azure Policy with remediation controls' is associated with this separate need: new resources regularly miss a mandatory billing tag. That is because policy can enforce tagging rules systematically; portal advice alone does not remediate missing tags. Here a finance team adds project tags today and expects yesterday's historical usage to be fully reclassified, so 'Assign a tag inheritance or modify Azure Policy with remediation controls' misses the fact that cost attribution depends on ingestion period and tagging at usage time; verify report behavior. 'Tag changes do not automatically rewrite all historical usage attribution' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Filter by consistent cost-center tags and verified subscription/resource scopes' solves another task because tag coverage and cost period must be checked, because missing or late-applied tags can skew attribution. For the situation where a finance team adds project tags today and expects yesterday's historical usage to be fully reclassified, this distractor misses the requirement that cost attribution depends on ingestion period and tagging at usage time; verify report behavior. Unlike 'Filter by consistent cost-center tags and verified subscription/resource scopes', 'Tag changes do not automatically rewrite all historical usage attribution' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Treat tag metadata separately from Azure RBAC permission assignments' applies to a different feature boundary because tags are classification metadata unless explicit conditional access logic references them. In the stated scenario where a finance team adds project tags today and expects yesterday's historical usage to be fully reclassified, 'Treat tag metadata separately from Azure RBAC permission assignments' does not satisfy the mechanism that cost attribution depends on ingestion period and tagging at usage time; verify report behavior. The necessary action is 'Tag changes do not automatically rewrite all historical usage attribution', which should be checked against this Azure resource's actual permissions and state.