Microsoft Updated AZ-104 Exam Questions and Answers by sean

To ensure that users can view only specific blobs based on blob index tags, the correct solution is to configure Azure Role-Based Access Control (RBAC) role assignment conditions that use Azure Blob Index Tags for fine-grained data access.

According to the Microsoft Azure Administrator documentation, Blob index tags provide the ability to categorize and filter blobs within a storage account using key-value pairs. However, controlling access to blobs based on their index tags requires role assignment conditions, which is a feature of Azure RBAC conditional access for data actions.

This functionality is part of Azure Attribute-Based Access Control (ABAC). ABAC extends RBAC by adding conditions to role assignments so that access decisions can include resource attributes such as blob index tags or security principal attributes.

When you apply an RBAC role assignment with a condition, you can restrict access at the object level within a resource type. For example, you can grant a user the Storage Blob Data Reader role but restrict their access only to blobs that contain a specific tag, such as:

@Resource[Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/Department] StringEquals ' Finance '

This configuration ensures that even if multiple users have the same role, they can only view blobs whose tags match the condition defined in their role assignment.

Alternative options explained:

A. Just-in-time (JIT) VM access → Used for securing virtual machines via Azure Security Center, not for blob data access control.

B. Shared access signature (SAS) → Provides temporary access to storage resources but cannot filter access based on blob index tags.

C. Stored access policy → Used to manage SAS tokens collectively but still does not support tag-based conditional access.

Therefore, the only mechanism that supports tag-based, condition-level access control for Azure Storage blobs is Role Assignment Conditions (Azure RBAC ABAC).

This aligns with the Microsoft Azure documentation on ABAC for Azure Storage, which explicitly states:

“You can use role assignment conditions in Azure Storage to control access to blobs based on blob index tags.”

https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept#how-are-role-assignable-groups-protected

" Group nesting isn ' t supported. A group can ' t be added as a member of a role-assignable group. "

For the second question:

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-manage-groups#add-or-remove-a-group-from-another-group

" We currently don ' t support:

Adding Microsoft 365 groups to Security groups or other Microsoft 365 groups.

"

For the third question, although it appears truncated in the screenshot (ending with " for... " ) there is a reference about Microsoft 365 groups support for roles assignment here:

https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept#how-role-assignments-to-groups-work

" To assign a role to a group, you must create a new security or Microsoft 365 group with the isAssignableToRole property set to true. "

When Microsoft schedules maintenance that may affect a virtual machine (VM), administrators have two options:

Wait for Azure to perform the maintenance automatically.

Move the VM to a new host proactively to minimize or avoid downtime.

According to the Microsoft Azure Administrator documentation, using the “Redeploy + reapply” option in the Azure portal forces the VM to migrate to a new Azure host within the same region and availability set.

Here’s what happens when you click Redeploy:

Azure shuts down the existing VM.

The VM is moved to a new physical host within the same region.

The operating system disk and data disks are retained, and network configuration (NICs, public IP, etc.) is preserved.

Once redeployed, Azure reassigns the VM to the same virtual network and reattaches disks and configurations.

This method is explicitly recommended by Microsoft to proactively address maintenance events or host-related issues like “unresponsive VM” or “performance degradation.”

Therefore, using the Redeploy operation from the “Redeploy + reapply” blade effectively achieves the goal of moving the VM to a different host immediately.

Scenario: Litware must meet technical requirements including:

Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.

IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.