Identity & governance
51 practice questions with explanations — 15 free to try
3 of these 51 questions are in the free 15-question taster · the full topic is part of Premium
PassNova has 51 Microsoft Azure Administrator (AZ-104) practice questions on Identity & governance, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Identity & governance: example questions & answers
3 worked examples with answers and explanations below. Try 15 Microsoft Azure Administrator (AZ-104) questions free in the browser; the full 51-question Identity & governance bank is part of PassNova Premium.
Which Azure RBAC role assignment scope can grant permissions across many subscriptions in a tenant with a single assignment?
- AResource scope
- BSubscription scope
- CManagement group scope✓
- DResource group scope
Answer: Assigning an Azure RBAC role at a management group scope cascades down to all subscriptions, resource groups, and resources beneath it, making it the broadest practical scope for governance.
You need to grant a user the ability to manage all resources in a resource group but NOT assign roles to others. Which built-in role should you use?
- AOwner
- BReader
- CUser Access Administrator
- DContributor✓
Answer: The Contributor role allows full management of resources but cannot grant access to others. Role assignments are managed by roles such as Owner, User Access Administrator and Role Based Access Control Administrator.
What is the purpose of an Azure Policy 'deny' effect?
- AIt logs non-compliant resources without blocking them
- BIt prevents a resource request that does not meet the policy condition✓
- CIt automatically remediates existing non-compliant resources
- DIt assigns a tag to compliant resources
Answer: The deny effect blocks resource creation or update requests during deployment when they violate the policy rule, enforcing standards before resources exist.