AZ104-Q: end a contractor’s Azure access
A contractor was granted access through a project group. What action cleanly removes the normal access path when the engagement ends?
- A) Rotate the subscription ID.
- B) Remove the guest from the access group, then review any direct assignments. ✓
- C) Delete all project resources.
- D) Assign the guest Reader permanently. Answer: B. Group-based access is easy to revoke; direct assignments still require review. Why not the others: The other choices are destructive, irrelevant, or extend access.