Topic 02 Practice Test 1 covers Azure RBAC and Resource Access for Microsoft Azure Administrator AZ-104 and maps to the objective: Manage access to Azure resources. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Contoso needs one administrator to create resources and assign Azure roles throughout a subscription. Which built-in role satisfies both capabilities? Choose ONE.
- Assign the Owner built-in role
- Assign the User Access Administrator built-in role
- Assign the Contributor built-in role
- Assign the Reader built-in role
Correct Answer: A
Correct Answer
Answer A is correct because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. In Contoso, this is the best fit because the administrator must manage resources and also grant Azure RBAC access at the same scope.
Incorrect Answers
Answer B is incorrect because User Access Administrator is focused on managing user access to Azure resources and can create or remove Azure role assignments. Applied to Contoso, this does not provide the required behavior because the administrator must manage resources and also grant Azure RBAC access at the same scope.
Answer C is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. The Contoso scenario instead requires that the administrator must manage resources and also grant Azure RBAC access at the same scope, so this option would leave the key requirement unresolved.
Answer D is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. For Contoso, that does not satisfy the requirement that the administrator must manage resources and also grant Azure RBAC access at the same scope; it solves a different administrative need.
Question 2
Fabrikam wants a subscription administrator who can manage workloads and delegate Azure RBAC access. Which built-in role is the direct fit? Choose ONE.
- Assign the Contributor built-in role
- Assign the Owner built-in role
- Assign the User Access Administrator built-in role
- Assign the Reader built-in role
Correct Answer: B
Correct Answer
Answer B is correct because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. The Fabrikam scenario specifically requires that the administrator must manage resources and also grant Azure RBAC access at the same scope, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. In Fabrikam, this is not sufficient because the administrator must manage resources and also grant Azure RBAC access at the same scope; the capability addresses a neighboring use case.
Answer C is incorrect because User Access Administrator is focused on managing user access to Azure resources and can create or remove Azure role assignments. For Fabrikam, that does not satisfy the requirement that the administrator must manage resources and also grant Azure RBAC access at the same scope; it solves a different administrative need.
Answer D is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. Applied to Fabrikam, this does not provide the required behavior because the administrator must manage resources and also grant Azure RBAC access at the same scope.
Question 3
Northwind wants an operations engineer to create and modify resources in a resource group but not grant access to other users. Which built-in role should be assigned? Choose ONE.
- Assign the Reader built-in role
- Assign the Owner built-in role
- Assign the Contributor built-in role
- Assign the User Access Administrator built-in role
Correct Answer: C
Correct Answer
Answer C is correct because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. Applied to the northwind wants an operations case, the capability meets the requirement that the operator must manage resources but must not be able to create Azure role assignments without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. In the northwind wants an operations case, this is not sufficient because the operator must manage resources but must not be able to create Azure role assignments; the capability addresses a neighboring use case.
Answer B is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. For the northwind wants an operations case, that does not satisfy the requirement that the operator must manage resources but must not be able to create Azure role assignments; it solves a different administrative need.
Answer D is incorrect because User Access Administrator is focused on managing user access to Azure resources and can create or remove Azure role assignments. The the northwind wants an operations case scenario instead requires that the operator must manage resources but must not be able to create Azure role assignments, so this option would leave the key requirement unresolved.
Question 4
Adventure Works needs a deployment engineer with broad resource management rights but no permission to change Azure RBAC assignments. Which role is best? Choose ONE.
- Assign the Owner built-in role
- Assign the User Access Administrator built-in role
- Assign the Reader built-in role
- Assign the Contributor built-in role
Correct Answer: D
Correct Answer
Answer D is correct because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. For Adventure Works, that directly satisfies the requirement that the operator must manage resources but must not be able to create Azure role assignments.
Incorrect Answers
Answer A is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. Applied to Adventure Works, this does not provide the required behavior because the operator must manage resources but must not be able to create Azure role assignments.
Answer B is incorrect because User Access Administrator is focused on managing user access to Azure resources and can create or remove Azure role assignments. In Adventure Works, this is not sufficient because the operator must manage resources but must not be able to create Azure role assignments; the capability addresses a neighboring use case.
Answer C is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The Adventure Works scenario instead requires that the operator must manage resources but must not be able to create Azure role assignments, so this option would leave the key requirement unresolved.
Question 5
Tailspin auditors need to view Azure resource settings but must not modify resources. They do not need to read blob contents. Which role should be assigned? Choose ONE.
- Assign the Reader built-in role
- Assign Storage Blob Data Reader at the blob-data scope
- Assign the Contributor built-in role
- Assign the Owner built-in role
Correct Answer: A
Correct Answer
Answer A is correct because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. In the tailspin auditors need to case, this is the best fit because the user needs read-only management-plane visibility of resource configuration.
Incorrect Answers
Answer B is incorrect because Storage Blob Data Reader includes blob data-plane read permissions, unlike the generic Reader role that primarily reads resource configuration. For the tailspin auditors need to case, that does not satisfy the requirement that the user needs read-only management-plane visibility of resource configuration; it solves a different administrative need.
Answer C is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. The the tailspin auditors need to case scenario instead requires that the user needs read-only management-plane visibility of resource configuration, so this option would leave the key requirement unresolved.
Answer D is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. Applied to the tailspin auditors need to case, this does not provide the required behavior because the user needs read-only management-plane visibility of resource configuration.
Question 6
Woodgrove gives a monitoring contractor visibility into resource configuration while prohibiting writes. Which built-in role is appropriate? Choose ONE.
- Assign the Contributor built-in role
- Assign the Reader built-in role
- Assign the Owner built-in role
- Assign Storage Blob Data Reader at the blob-data scope
Correct Answer: B
Correct Answer
Answer B is correct because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The the woodgrove gives a monitoring case scenario specifically requires that the user needs read-only management-plane visibility of resource configuration, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. In the woodgrove gives a monitoring case, this is not sufficient because the user needs read-only management-plane visibility of resource configuration; the capability addresses a neighboring use case.
Answer C is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. For the woodgrove gives a monitoring case, that does not satisfy the requirement that the user needs read-only management-plane visibility of resource configuration; it solves a different administrative need.
Answer D is incorrect because Storage Blob Data Reader includes blob data-plane read permissions, unlike the generic Reader role that primarily reads resource configuration. Applied to the woodgrove gives a monitoring case, this does not provide the required behavior because the user needs read-only management-plane visibility of resource configuration.
Question 7
Proseware needs a security administrator to grant and remove Azure RBAC access but not deploy application resources. Which built-in role best fits? Choose ONE.
- Assign the Contributor built-in role
- Assign the Reader built-in role
- Assign the User Access Administrator built-in role
- Assign the Owner built-in role
Correct Answer: C
Correct Answer
Answer C is correct because User Access Administrator is focused on managing user access to Azure resources and can create or remove Azure role assignments. Applied to Proseware, the capability meets the requirement that the delegated administrator should manage Azure resource access without being given broad resource-management permissions without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. In Proseware, this is not sufficient because the delegated administrator should manage Azure resource access without being given broad resource-management permissions; the capability addresses a neighboring use case.
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The Proseware scenario instead requires that the delegated administrator should manage Azure resource access without being given broad resource-management permissions, so this option would leave the key requirement unresolved.
Answer D is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. For Proseware, that does not satisfy the requirement that the delegated administrator should manage Azure resource access without being given broad resource-management permissions; it solves a different administrative need.
Question 8
Litware separates access administration from workload administration. Which role can manage Azure RBAC assignments without requiring Owner? Choose ONE.
- Assign the Contributor built-in role
- Assign the Reader built-in role
- Assign the Owner built-in role
- Assign the User Access Administrator built-in role
Correct Answer: D
Correct Answer
Answer D is correct because User Access Administrator is focused on managing user access to Azure resources and can create or remove Azure role assignments. For Litware, that directly satisfies the requirement that the delegated administrator should manage Azure resource access without being given broad resource-management permissions.
Incorrect Answers
Answer A is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. The Litware scenario instead requires that the delegated administrator should manage Azure resource access without being given broad resource-management permissions, so this option would leave the key requirement unresolved.
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. In Litware, this is not sufficient because the delegated administrator should manage Azure resource access without being given broad resource-management permissions; the capability addresses a neighboring use case.
Answer C is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. Applied to Litware, this does not provide the required behavior because the delegated administrator should manage Azure resource access without being given broad resource-management permissions.
Question 9
Wingtip wants a least-privileged administrator dedicated to creating and deleting Azure role assignments. Which built-in role is designed for that purpose? Choose ONE.
- Assign the Role Based Access Control Administrator built-in role
- Assign the Contributor built-in role
- Assign the Owner built-in role
- Assign the Reader built-in role
Correct Answer: A
Correct Answer
Answer A is correct because Role Based Access Control Administrator can manage Azure RBAC role assignments without granting broad resource-management permissions. In the wingtip wants a least-privileged case, this is the best fit because the administrator needs a role focused specifically on Azure RBAC role assignment administration.
Incorrect Answers
Answer B is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. Applied to the wingtip wants a least-privileged case, this does not provide the required behavior because the administrator needs a role focused specifically on Azure RBAC role assignment administration.
Answer C is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. The the wingtip wants a least-privileged case scenario instead requires that the administrator needs a role focused specifically on Azure RBAC role assignment administration, so this option would leave the key requirement unresolved.
Answer D is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. For the wingtip wants a least-privileged case, that does not satisfy the requirement that the administrator needs a role focused specifically on Azure RBAC role assignment administration; it solves a different administrative need.
Question 10
An administrator is documenting an Azure role assignment. Which TWO items, together with the principal, determine what access is granted and where? Choose TWO.
- Remove the Azure role assignment that grants the access
- Identify the principal, role definition, and scope for the assignment
- Use Access control (IAM) at the required scope and add a role assignment
- Assign the role to a Microsoft Entra security group
- Create the role assignment at the individual resource scope
Correct Answers: B, E
Correct Answers
Answer B is correct because An Azure role assignment connects a security principal to a role definition at a specific scope; all three elements determine the resulting authorization. The the an administrator is documenting case scenario specifically requires that the role definition determines permitted actions and the scope determines where those actions apply, so this choice matches the intended behavior.
Answer E is correct because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. Applied to the an administrator is documenting case, the capability meets the requirement that the role definition determines permitted actions and the scope determines where those actions apply without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. The the an administrator is documenting case scenario instead requires that the role definition determines permitted actions and the scope determines where those actions apply, so this option would leave the key requirement unresolved.
Answer C is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. In the an administrator is documenting case, this is not sufficient because the role definition determines permitted actions and the scope determines where those actions apply; the capability addresses a neighboring use case.
Answer D is incorrect because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. For the an administrator is documenting case, that does not satisfy the requirement that the role definition determines permitted actions and the scope determines where those actions apply; it solves a different administrative need.
Question 11
- Datum creates a team responsible only for Azure RBAC administration. Which role aligns most closely with that responsibility? Choose ONE.
- Assign the Owner built-in role
- Assign the Reader built-in role
- Assign the Role Based Access Control Administrator built-in role
- Assign the Contributor built-in role
Correct Answer: C
Correct Answer
Answer C is correct because Role Based Access Control Administrator can manage Azure RBAC role assignments without granting broad resource-management permissions. Applied to A. Datum, the capability meets the requirement that the administrator needs a role focused specifically on Azure RBAC role assignment administration without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. The A. Datum scenario instead requires that the administrator needs a role focused specifically on Azure RBAC role assignment administration, so this option would leave the key requirement unresolved.
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. For A. Datum, that does not satisfy the requirement that the administrator needs a role focused specifically on Azure RBAC role assignment administration; it solves a different administrative need.
Answer D is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. In A. Datum, this is not sufficient because the administrator needs a role focused specifically on Azure RBAC role assignment administration; the capability addresses a neighboring use case.
Question 12
Contoso must let an app read one storage account and no other resources in its resource group. At which Azure RBAC scope should the role be assigned? Choose ONE.
- Create the role assignment at the resource-group scope
- Create the role assignment at management-group scope
- Create the role assignment at subscription scope
- Create the role assignment at the individual resource scope
Correct Answer: D
Correct Answer
Answer D is correct because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. For Contoso, that directly satisfies the requirement that only one specific Azure resource should be accessible and least privilege requires the narrowest scope.
Incorrect Answers
Answer A is incorrect because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. In Contoso, this is not sufficient because only one specific Azure resource should be accessible and least privilege requires the narrowest scope; the capability addresses a neighboring use case.
Answer B is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. Applied to Contoso, this does not provide the required behavior because only one specific Azure resource should be accessible and least privilege requires the narrowest scope.
Answer C is incorrect because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. The Contoso scenario instead requires that only one specific Azure resource should be accessible and least privilege requires the narrowest scope, so this option would leave the key requirement unresolved.
Question 13
Fabrikam needs a managed identity to access exactly one Key Vault while other resources in the same resource group remain out of scope. Which assignment scope is best? Choose ONE.
- Create the role assignment at the individual resource scope
- Create the role assignment at subscription scope
- Create the role assignment at management-group scope
- Create the role assignment at the resource-group scope
Correct Answer: A
Correct Answer
Answer A is correct because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. In Fabrikam, this is the best fit because only one specific Azure resource should be accessible and least privilege requires the narrowest scope.
Incorrect Answers
Answer B is incorrect because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. Applied to Fabrikam, this does not provide the required behavior because only one specific Azure resource should be accessible and least privilege requires the narrowest scope.
Answer C is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. The Fabrikam scenario instead requires that only one specific Azure resource should be accessible and least privilege requires the narrowest scope, so this option would leave the key requirement unresolved.
Answer D is incorrect because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. For Fabrikam, that does not satisfy the requirement that only one specific Azure resource should be accessible and least privilege requires the narrowest scope; it solves a different administrative need.
Question 14
Northwind wants an operations group to manage every resource in RG-App but nowhere else in the subscription. Which scope should the role assignment use? Choose ONE.
- Create the role assignment at the individual resource scope
- Create the role assignment at the resource-group scope
- Create the role assignment at management-group scope
- Create the role assignment at subscription scope
Correct Answer: B
Correct Answer
Answer B is correct because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. The the northwind wants an operations case scenario specifically requires that the same role should apply to all current and future resources inside one resource group, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. Applied to the northwind wants an operations case, this does not provide the required behavior because the same role should apply to all current and future resources inside one resource group.
Answer C is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. In the northwind wants an operations case, this is not sufficient because the same role should apply to all current and future resources inside one resource group; the capability addresses a neighboring use case.
Answer D is incorrect because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. For the northwind wants an operations case, that does not satisfy the requirement that the same role should apply to all current and future resources inside one resource group; it solves a different administrative need.
Question 15
Adventure Works needs permissions inherited by resources deployed into one designated resource group. What is the most appropriate Azure RBAC scope? Choose ONE.
- Create the role assignment at subscription scope
- Create the role assignment at management-group scope
- Create the role assignment at the resource-group scope
- Create the role assignment at the individual resource scope
Correct Answer: C
Correct Answer
Answer C is correct because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. Applied to Adventure Works, the capability meets the requirement that the same role should apply to all current and future resources inside one resource group without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. In Adventure Works, this is not sufficient because the same role should apply to all current and future resources inside one resource group; the capability addresses a neighboring use case.
Answer B is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. For Adventure Works, that does not satisfy the requirement that the same role should apply to all current and future resources inside one resource group; it solves a different administrative need.
Answer D is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. The Adventure Works scenario instead requires that the same role should apply to all current and future resources inside one resource group, so this option would leave the key requirement unresolved.
Question 16
Tailspin needs a security team to read all resources across a single subscription. Which scope should be used for one inherited role assignment? Choose ONE.
- Create the role assignment at management-group scope
- Create the role assignment at the resource-group scope
- Create the role assignment at the individual resource scope
- Create the role assignment at subscription scope
Correct Answer: D
Correct Answer
Answer D is correct because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. For the tailspin needs a security case, that directly satisfies the requirement that the role should apply to every resource group and resource in one subscription.
Incorrect Answers
Answer A is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. Applied to the tailspin needs a security case, this does not provide the required behavior because the role should apply to every resource group and resource in one subscription.
Answer B is incorrect because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. The the tailspin needs a security case scenario instead requires that the role should apply to every resource group and resource in one subscription, so this option would leave the key requirement unresolved.
Answer C is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. In the tailspin needs a security case, this is not sufficient because the role should apply to every resource group and resource in one subscription; the capability addresses a neighboring use case.
Question 17
Woodgrove wants one role assignment that covers all existing and future resource groups in Subscription-A but no other subscriptions. Which scope is correct? Choose ONE.
- Create the role assignment at subscription scope
- Create the role assignment at the resource-group scope
- Create the role assignment at management-group scope
- Create the role assignment at the individual resource scope
Correct Answer: A
Correct Answer
Answer A is correct because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. In the woodgrove wants one role case, this is the best fit because the role should apply to every resource group and resource in one subscription.
Incorrect Answers
Answer B is incorrect because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. Applied to the woodgrove wants one role case, this does not provide the required behavior because the role should apply to every resource group and resource in one subscription.
Answer C is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. The the woodgrove wants one role case scenario instead requires that the role should apply to every resource group and resource in one subscription, so this option would leave the key requirement unresolved.
Answer D is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. For the woodgrove wants one role case, that does not satisfy the requirement that the role should apply to every resource group and resource in one subscription; it solves a different administrative need.
Question 18
Proseware operates five subscriptions beneath MG-Platform and needs one inherited Reader assignment across all five. Where should the assignment be created? Choose ONE.
- Create the role assignment at subscription scope
- Create the role assignment at management-group scope
- Create the role assignment at the individual resource scope
- Create the role assignment at the resource-group scope
Correct Answer: B
Correct Answer
Answer B is correct because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. The Proseware scenario specifically requires that the same role must be inherited across several subscriptions under one management group, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. Applied to Proseware, this does not provide the required behavior because the same role must be inherited across several subscriptions under one management group.
Answer C is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. In Proseware, this is not sufficient because the same role must be inherited across several subscriptions under one management group; the capability addresses a neighboring use case.
Answer D is incorrect because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. For Proseware, that does not satisfy the requirement that the same role must be inherited across several subscriptions under one management group; it solves a different administrative need.
Question 19
Litware needs consistent Azure RBAC access across every subscription under a management group. Which scope provides the broadest intended inheritance? Choose ONE.
- Create the role assignment at subscription scope
- Create the role assignment at the individual resource scope
- Create the role assignment at management-group scope
- Create the role assignment at the resource-group scope
Correct Answer: C
Correct Answer
Answer C is correct because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. Applied to Litware, the capability meets the requirement that the same role must be inherited across several subscriptions under one management group without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. The Litware scenario instead requires that the same role must be inherited across several subscriptions under one management group, so this option would leave the key requirement unresolved.
Answer B is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. For Litware, that does not satisfy the requirement that the same role must be inherited across several subscriptions under one management group; it solves a different administrative need.
Answer D is incorrect because A role assigned at resource-group scope applies to the group and is inherited by resources beneath that resource group. In Litware, this is not sufficient because the same role must be inherited across several subscriptions under one management group; the capability addresses a neighboring use case.
Question 20
A workload needs least-privileged read access to blob data in one storage account. Which TWO choices best match the requirement? Choose TWO.
- Assign the Owner built-in role
- Assign Storage Blob Data Reader at the blob-data scope
- Create the role assignment at subscription scope
- Assign the Reader built-in role
- Create the role assignment at the individual resource scope
Correct Answers: B, E
Correct Answers
Answer B is correct because Storage Blob Data Reader includes blob data-plane read permissions, unlike the generic Reader role that primarily reads resource configuration. For the a workload needs least-privileged case, that directly satisfies the requirement that the data-plane role must permit blob reads and the assignment should be scoped to the one required resource.
Answer E is correct because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. In the a workload needs least-privileged case, this is the best fit because the data-plane role must permit blob reads and the assignment should be scoped to the one required resource.
Incorrect Answers
Answer A is incorrect because Owner can manage Azure resources and also assign Azure RBAC roles, making it broader than Contributor. For the a workload needs least-privileged case, that does not satisfy the requirement that the data-plane role must permit blob reads and the assignment should be scoped to the one required resource; it solves a different administrative need.
Answer C is incorrect because A subscription-scope role assignment applies throughout the subscription and is inherited by child resource groups and resources. Applied to the a workload needs least-privileged case, this does not provide the required behavior because the data-plane role must permit blob reads and the assignment should be scoped to the one required resource.
Answer D is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The the a workload needs least-privileged case scenario instead requires that the data-plane role must permit blob reads and the assignment should be scoped to the one required resource, so this option would leave the key requirement unresolved.
