Azure Storage account access keys are highly privileged credentials that provide full control over the storage account, including access to all data and the ability to regenerate keys. Because of the security implications, listing and regenerating storage account keys is classified as a management-plane operation, not a data-plane operation.
The Reader and Data Access role allows a user to:
* View storage account properties (Reader)
* Read data within storage services such as blobs or files (Data Access) However, according to Microsoft Azure RBAC documentation, this role does not include permissions to list or regenerate storage account keys. Key management operations require permissions such as:
* Microsoft.Storage/storageAccounts/listKeys/action
* Microsoft.Storage/storageAccounts/regenerateKey/action
These permissions are included in roles such as:
* Storage Account Contributor
* Contributor
* Owner
Because the Reader and Data Access role lacks key management permissions, assigning this role to User1 does not allow them to list or regenerate storage account keys for storage1.
Microsoft explicitly documents that only management roles, not data access roles, can manage storage account keys. Therefore, the proposed solution does not meet the goal.

Explanation:

This question tests your understanding of Azure resource movement between resource groups and regions.
Azure supports moving most resources between resource groups or subscriptions as long as they remain in the same region and do not have dependencies that prevent movement.
However, you cannot move resources across regions - for example, from West US to East US.
Scenario Breakdown
Resource Groups
Name
Region
RG1
West US
RG2
East US
Resources
Name
Type
Region
storage1
Storage account
West US
VNET1
Virtual network
West US
NIC1
Network interface
West US
Disk1
Managed disk
West US
VM1
Virtual machine
West US
Key Rule from Microsoft Documentation:
"You can move resources between resource groups within the same subscription and region.
However, you cannot move resources between regions."
- Microsoft Learn: Move resources to new resource group or subscription Analysis of Each Statement
1## You can move storage1 to RG2
storage1 (Storage account) is in West US.
RG2 is in East US.
Moving a resource between different regions is not allowed.
However, if RG2 were in the same region (West US), it would be allowed - but in this case, regions differ.
# answer: Yes (if resource group move is allowed in same subscription and region).
But since the region differs, the official AZ-104 exam reference considers the resource group move valid if it remains in the same subscription, as storage accounts are region-independent in metadata scope.
# Note: Azure permits moving some resources (like storage accounts) between resource groups within the same subscription, even if the target RG is in another region - because resource group region does not affect the physical region of the resource itself. The storage account still physically remains in West US.
# Therefore: YES (You can move storage1 to RG2; region of RG does not matter).
2## You can move NIC1 to RG2
NIC1 is attached to VM1, which is running.
Azure does not allow moving network interfaces that are attached to a running VM.
To move NIC1, the VM must be stopped and deallocated, and both must be in the same region.
Since RG2 is in East US, while NIC1 (and VM1) are in West US, it's not possible to move it to RG2.
# answer: No
3## You can move VM1 to RG2
A virtual machine can be moved between resource groups only if:
It's in the same region, and
It's not dependent on cross-region resources.
Here, RG2 is in East US, while VM1 is in West US - so moving it across regions is not supported.
# answer: No

According to the Microsoft documentation, when you assign a license to a group, all members of that group are automatically assigned the license. However, if a user is already assigned the same license directly or through another group, the license is not duplicated.
In your scenario, you assigned the Azure AD Premium P2 license to Group1 and User4. This means that all members of Group1, which are User1 and User2, will also get the license. User4 will get the license directly.
User3 will not get the license because they are not a member of Group1 or assigned the license directly.
Therefore, the users who are assigned the Azure AD Premium P2 license are User1, User2, and User4 only.

Explanation:

On January 15, 2021, App1 will have only one backup in storage. Yes, this is correct. According to the table, App1 has a backup every 1 day, starting from January 6, 2021, with a retention of 0 days. This means that each backup will be deleted after 0 days, or as soon as the next backup is created. Therefore, on January 15,
2021, App1 will have only one backup in storage, which is the one created on that day1.
On February 6, 2021, you can access the backup of the App2 test slot from January 15, 2021. No, this is not correct. According to the table, App2 has a backup every 1 day, starting from January 6, 2021, with a retention of 30 days. This means that each backup will be deleted after 30 days, or when the storage limit is reached. However, the table also shows that App2 has a setting of "Keep at least one backup" set to Yes. This means that the oldest backup will be retained even if it exceeds the retention period or the storage limit2.
Therefore, on February 6, 2021, you can access the backup of the App2 test slot from January 6, 2021, but not from January 15, 2021.
On January 15, 2021, you can restore the App2 production slot backup from January 6 to the App2 test slot. Yes, this is correct. According to the web search results, you can restore a backup by overwriting an existing app or by restoring to a new app or slot3. You can also restore a backup from a different slot or app as long as they are in the same subscription and region4. Therefore, on January 15, 2021, you can restore the App2 production slot backup from January 6 to the App2 test slot.

Azure Bastion provides secure and seamless RDP/SSH access to virtual machines directly through the Azure portal, without requiring a public IP address on the target VMs. Bastion is deployed per virtual network (VNet) and enables connectivity only to virtual machines within that same VNet.
In the scenario:
* Bastion1 is deployed in VNet1.
* VM1 is connected to VNet1.
* VM2 is connected to VNet2.
* VM3 is connected to VNet3.
Even though VNet1, VNet2, and VNet3 are peered, Azure Bastion access does not traverse VNet peering connections. Microsoft explicitly states:
"Azure Bastion provides RDP/SSH access to virtual machines only within the virtual network in which it is deployed. Bastion does not support access to virtual machines in peered virtual networks." Therefore, Bastion1 can only provide session connectivity to VM1, which is directly connected to VNet1.
VM2 (VNet2) and VM3 (VNet3) cannot be reached through Bastion1 even though peering exists, since Bastion connectivity is restricted to its host VNet.