Manage Azure identities and governance

You have 15 Azure subscriptions. You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You plan to purchase an additional Azure subscription. You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements:
- Use the principle of least privilege.

- Minimize administrative effort.an additional

• Assign Group1 the Owner role for the root management group.

• Assign Group1 the User Access Administrator role for the root management group

• Create a new management group and assign Group1 the User Access Administrator role for the group.

• Create a new management group and assign Group1 the Owner role for the group.

You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: - Reader - Security Admin - Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

• Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.

• Assign User1 the Owner role for VNet1.

• Assign User1 the Contributor role for VNet1.

• Assign User1 the Network Contributor role for VNet1.

You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named storage1. You need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The solution must use the principle of least privilege. Which two roles should you configure for storage!? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point

• Reader

• Storage Blob Data Contributor

• Storage Account Contributor

• Storage Blob Data Reader

• Contributor

You need to assign a user the ability to manage resources in a specific resource group but not grant access to other resources. Which role should you assign?

• Owner at the subscription level

• Contributor at the resource group level

• Reader at the management group level

• User Access Administrator at the tenant level

You are asked to ensure that only virtual machines of a specific size can be deployed in a resource group. What should you use?

• Azure RBAC

• Azure Monitor

• Azure Blueprints

• Azure Policy

A user needs to reset passwords for other users but should not have full administrative rights. Which role should you assign?

• Global Administrator

• User Administrator

• Password Administrator

• Helpdesk Administrator

You want to delegate administrative control over a specific department’s users without affecting the rest of the organization. What should you use?

• Administrative Units

• Azure AD Connect

• Management Groups

• Azure Policy

You have an Azure subscription. Your company policy dictates that all Azure Virtual Machines (VMs) deployed in the subscription must have the Department tag with a non-empty value. You need to implement this requirement using Azure Policy.

Which policy effect should you use for the Azure Policy definition?

• Audit

• Deny

• Append

• DeployIfNotExist

Your company uses a hybrid identity solution with Microsoft Entra Connect synchronizing user accounts from your on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID. You want to enable Self-Service Password Reset (SSPR) for all users, including those synchronized from on-premises AD DS. Users should be able to reset their passwords and have the new password written back to the on-premises AD DS.

Which two prerequisites must be met to achieve this? (Choose two.)

• All users must have a Microsoft Entra ID Free license.

• Microsoft Entra Connect must be installed and configured with Password Hash Synchronization or Pass-through Authentication.

• Microsoft Entra ID P1 or P2 licenses must be assigned to the users who will use SSPR.

• Azure AD Domain Services must be enabled in your Azure subscription.

• Users must be part of a dynamic group configured for SSPR.

Your organization has several Azure subscriptions: DevSubscription, TestSubscription, and ProdSubscription. You need to ensure that a specific set of Azure Policies related to data residency are applied consistently across all three subscriptions, without having to assign them individually to each subscription.

What is the most efficient way to achieve this?

• Assign the policies to each subscription directly.

• Create a resource group in each subscription and assign the policies to those resource groups.

• Create an Azure Management Group, move all three subscriptions into it, and assign the policies to the Management Group.

• Use Azure Blueprints to deploy the policies to each subscription.