Topic 02 Practice Test 2 covers Azure RBAC and Resource Access for Microsoft Azure Administrator AZ-104 and maps to the objective: Manage access to Azure resources. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Wingtip wants engineers to receive a resource-group role when added to the Cloud-Ops group and lose it when removed. Which principal should receive the role assignment? Choose ONE.
- Assign the role to a Microsoft Entra security group
- Assign the Reader built-in role
- Assign the role to the application service principal
- Assign the role to the managed identity
Correct Answer: A
Correct Answer
Answer A is correct because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. The the wingtip wants engineers to case scenario specifically requires that access should automatically follow employee membership in a centrally managed group, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. In the wingtip wants engineers to case, this is not sufficient because access should automatically follow employee membership in a centrally managed group; the capability addresses a neighboring use case.
Answer C is incorrect because A service principal represents an application or workload identity and can receive Azure RBAC permissions through role assignments. Applied to the wingtip wants engineers to case, this does not provide the required behavior because access should automatically follow employee membership in a centrally managed group.
Answer D is incorrect because A managed identity is a service principal that Azure manages, and it can be used as the principal in an Azure role assignment. For the wingtip wants engineers to case, that does not satisfy the requirement that access should automatically follow employee membership in a centrally managed group; it solves a different administrative need.
Question 2
- Datum wants to manage human Azure access through one membership object instead of individual user assignments. Which principal type should be used? Choose ONE.
- Assign the role to the application service principal
- Assign the role to a Microsoft Entra security group
- Assign the role to the managed identity
- Assign the Reader built-in role
Correct Answer: B
Correct Answer
Answer B is correct because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. Applied to A. Datum, the capability meets the requirement that access should automatically follow employee membership in a centrally managed group without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because A service principal represents an application or workload identity and can receive Azure RBAC permissions through role assignments. The A. Datum scenario instead requires that access should automatically follow employee membership in a centrally managed group, so this option would leave the key requirement unresolved.
Answer C is incorrect because A managed identity is a service principal that Azure manages, and it can be used as the principal in an Azure role assignment. In A. Datum, this is not sufficient because access should automatically follow employee membership in a centrally managed group; the capability addresses a neighboring use case.
Answer D is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. For A. Datum, that does not satisfy the requirement that access should automatically follow employee membership in a centrally managed group; it solves a different administrative need.
Question 3
Contoso has a VM with a system-assigned managed identity that must read secrets from Key Vault. Which principal should receive the Azure RBAC assignment? Choose ONE.
- Assign the role to a Microsoft Entra security group
- Assign the Reader built-in role
- Assign the role to the managed identity
- Assign the role to the application service principal
Correct Answer: C
Correct Answer
Answer C is correct because A managed identity is a service principal that Azure manages, and it can be used as the principal in an Azure role assignment. For Contoso, that directly satisfies the requirement that an Azure-hosted workload should authenticate without a stored application secret.
Incorrect Answers
Answer A is incorrect because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. The Contoso scenario instead requires that an Azure-hosted workload should authenticate without a stored application secret, so this option would leave the key requirement unresolved.
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. Applied to Contoso, this does not provide the required behavior because an Azure-hosted workload should authenticate without a stored application secret.
Answer D is incorrect because A service principal represents an application or workload identity and can receive Azure RBAC permissions through role assignments. In Contoso, this is not sufficient because an Azure-hosted workload should authenticate without a stored application secret; the capability addresses a neighboring use case.
Question 4
Fabrikam wants an Azure service workload to use its managed identity for authorization instead of storing credentials. What should be assigned the role? Choose ONE.
- Assign the role to the application service principal
- Assign the Reader built-in role
- Assign the role to a Microsoft Entra security group
- Assign the role to the managed identity
Correct Answer: D
Correct Answer
Answer D is correct because A managed identity is a service principal that Azure manages, and it can be used as the principal in an Azure role assignment. In Fabrikam, this is the best fit because an Azure-hosted workload should authenticate without a stored application secret.
Incorrect Answers
Answer A is incorrect because A service principal represents an application or workload identity and can receive Azure RBAC permissions through role assignments. For Fabrikam, that does not satisfy the requirement that an Azure-hosted workload should authenticate without a stored application secret; it solves a different administrative need.
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The Fabrikam scenario instead requires that an Azure-hosted workload should authenticate without a stored application secret, so this option would leave the key requirement unresolved.
Answer C is incorrect because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. Applied to Fabrikam, this does not provide the required behavior because an Azure-hosted workload should authenticate without a stored application secret.
Question 5
Northwind has a CI/CD application with a Microsoft Entra service principal. The pipeline needs access to one resource group. Which principal receives the role? Choose ONE.
- Assign the role to the application service principal
- Assign the Reader built-in role
- Assign the role to a Microsoft Entra security group
- Assign the role to the managed identity
Correct Answer: A
Correct Answer
Answer A is correct because A service principal represents an application or workload identity and can receive Azure RBAC permissions through role assignments. The the northwind has a ci case scenario specifically requires that a registered application represented by a service principal needs the Azure resource permission, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. In the northwind has a ci case, this is not sufficient because a registered application represented by a service principal needs the Azure resource permission; the capability addresses a neighboring use case.
Answer C is incorrect because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. For the northwind has a ci case, that does not satisfy the requirement that a registered application represented by a service principal needs the Azure resource permission; it solves a different administrative need.
Answer D is incorrect because A managed identity is a service principal that Azure manages, and it can be used as the principal in an Azure role assignment. Applied to the northwind has a ci case, this does not provide the required behavior because a registered application represented by a service principal needs the Azure resource permission.
Question 6
Adventure Works authorizes a non-Azure-hosted automation application represented by a service principal. Which identity should be targeted by the role assignment? Choose ONE.
- Assign the Reader built-in role
- Assign the role to the application service principal
- Assign the role to a Microsoft Entra security group
- Assign the role to the managed identity
Correct Answer: B
Correct Answer
Answer B is correct because A service principal represents an application or workload identity and can receive Azure RBAC permissions through role assignments. Applied to Adventure Works, the capability meets the requirement that a registered application represented by a service principal needs the Azure resource permission without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. For Adventure Works, that does not satisfy the requirement that a registered application represented by a service principal needs the Azure resource permission; it solves a different administrative need.
Answer C is incorrect because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. In Adventure Works, this is not sufficient because a registered application represented by a service principal needs the Azure resource permission; the capability addresses a neighboring use case.
Answer D is incorrect because A managed identity is a service principal that Azure manages, and it can be used as the principal in an Azure role assignment. The Adventure Works scenario instead requires that a registered application represented by a service principal needs the Azure resource permission, so this option would leave the key requirement unresolved.
Question 7
Tailspin is viewing a resource group in the Azure portal and needs to grant a group the Reader role. Which blade should be used? Choose ONE.
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Remove the Azure role assignment that grants the access
- Use Access control (IAM) at the required scope and add a role assignment
- Review role assignments including inherited parent-scope assignments
Correct Answer: C
Correct Answer
Answer C is correct because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. For the tailspin is viewing a case, that directly satisfies the requirement that the administrator must create a role assignment in the Azure portal at the selected scope.
Incorrect Answers
Answer A is incorrect because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. Applied to the tailspin is viewing a case, this does not provide the required behavior because the administrator must create a role assignment in the Azure portal at the selected scope.
Answer B is incorrect because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. In the tailspin is viewing a case, this is not sufficient because the administrator must create a role assignment in the Azure portal at the selected scope; the capability addresses a neighboring use case.
Answer D is incorrect because Access at a child resource can come from a direct assignment or from a parent scope, so inherited assignments must be included when interpreting effective access. The the tailspin is viewing a case scenario instead requires that the administrator must create a role assignment in the Azure portal at the selected scope, so this option would leave the key requirement unresolved.
Question 8
Woodgrove needs to add an Azure role assignment directly from the selected subscription in the portal. Which management surface is appropriate? Choose ONE.
- Review role assignments including inherited parent-scope assignments
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Remove the Azure role assignment that grants the access
- Use Access control (IAM) at the required scope and add a role assignment
Correct Answer: D
Correct Answer
Answer D is correct because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. In the woodgrove needs to add case, this is the best fit because the administrator must create a role assignment in the Azure portal at the selected scope.
Incorrect Answers
Answer A is incorrect because Access at a child resource can come from a direct assignment or from a parent scope, so inherited assignments must be included when interpreting effective access. Applied to the woodgrove needs to add case, this does not provide the required behavior because the administrator must create a role assignment in the Azure portal at the selected scope.
Answer B is incorrect because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. The the woodgrove needs to add case scenario instead requires that the administrator must create a role assignment in the Azure portal at the selected scope, so this option would leave the key requirement unresolved.
Answer C is incorrect because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. For the woodgrove needs to add case, that does not satisfy the requirement that the administrator must create a role assignment in the Azure portal at the selected scope; it solves a different administrative need.
Question 9
Proseware removes a contractor’s access to a resource group but must keep the guest account for another application. What should be removed? Choose ONE.
- Remove the Azure role assignment that grants the access
- Assign the Reader built-in role
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Use Access control (IAM) at the required scope and add a role assignment
Correct Answer: A
Correct Answer
Answer A is correct because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. The Proseware scenario specifically requires that the specific Azure RBAC grant must be revoked while keeping the identity and resource intact, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. For Proseware, that does not satisfy the requirement that the specific Azure RBAC grant must be revoked while keeping the identity and resource intact; it solves a different administrative need.
Answer C is incorrect because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. In Proseware, this is not sufficient because the specific Azure RBAC grant must be revoked while keeping the identity and resource intact; the capability addresses a neighboring use case.
Answer D is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. Applied to Proseware, this does not provide the required behavior because the specific Azure RBAC grant must be revoked while keeping the identity and resource intact.
Question 10
A user can read a VM despite having no direct assignment on the VM. Which TWO areas should the administrator evaluate first? Choose TWO.
- Use Access control (IAM) at the required scope and add a role assignment
- Review role assignments including inherited parent-scope assignments
- Remove the Azure role assignment that grants the access
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Assign the role to a Microsoft Entra security group
Correct Answers: B, E
Correct Answers
Answer B is correct because Access at a child resource can come from a direct assignment or from a parent scope, so inherited assignments must be included when interpreting effective access. Applied to the a user can read case, the capability meets the requirement that parent-scope inheritance and group-based principal membership can both grant access without adding unrelated scope.
Answer E is correct because Using a group as the principal centralizes access lifecycle: users gain or lose the Azure role through group membership. For the a user can read case, that directly satisfies the requirement that parent-scope inheritance and group-based principal membership can both grant access.
Incorrect Answers
Answer A is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. Applied to the a user can read case, this does not provide the required behavior because parent-scope inheritance and group-based principal membership can both grant access.
Answer C is incorrect because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. In the a user can read case, this is not sufficient because parent-scope inheritance and group-based principal membership can both grant access; the capability addresses a neighboring use case.
Answer D is incorrect because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. The the a user can read case scenario instead requires that parent-scope inheritance and group-based principal membership can both grant access, so this option would leave the key requirement unresolved.
Question 11
Litware needs to revoke one managed identity’s storage role without deleting the identity or storage account. Which action is correct? Choose ONE.
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Use Access control (IAM) at the required scope and add a role assignment
- Remove the Azure role assignment that grants the access
- Assign the Reader built-in role
Correct Answer: C
Correct Answer
Answer C is correct because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. For Litware, that directly satisfies the requirement that the specific Azure RBAC grant must be revoked while keeping the identity and resource intact.
Incorrect Answers
Answer A is incorrect because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. In Litware, this is not sufficient because the specific Azure RBAC grant must be revoked while keeping the identity and resource intact; the capability addresses a neighboring use case.
Answer B is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. Applied to Litware, this does not provide the required behavior because the specific Azure RBAC grant must be revoked while keeping the identity and resource intact.
Answer D is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The Litware scenario instead requires that the specific Azure RBAC grant must be revoked while keeping the identity and resource intact, so this option would leave the key requirement unresolved.
Question 12
Wingtip assigns Reader on a storage account, but the auditor still cannot read private blobs. Which role better matches the required data-plane access? Choose ONE.
- Assign the Reader built-in role
- Assign the Contributor built-in role
- Create the role assignment at the individual resource scope
- Assign Storage Blob Data Reader at the blob-data scope
Correct Answer: D
Correct Answer
Answer D is correct because Storage Blob Data Reader includes blob data-plane read permissions, unlike the generic Reader role that primarily reads resource configuration. In the wingtip assigns reader on case, this is the best fit because the user must read blob data contents rather than only the storage account configuration.
Incorrect Answers
Answer A is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The the wingtip assigns reader on case scenario instead requires that the user must read blob data contents rather than only the storage account configuration, so this option would leave the key requirement unresolved.
Answer B is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. Applied to the wingtip assigns reader on case, this does not provide the required behavior because the user must read blob data contents rather than only the storage account configuration.
Answer C is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. For the wingtip assigns reader on case, that does not satisfy the requirement that the user must read blob data contents rather than only the storage account configuration; it solves a different administrative need.
Question 13
- Datum needs an analyst to read blob contents while avoiding write permission. Which Azure built-in role should be selected? Choose ONE.
- Assign Storage Blob Data Reader at the blob-data scope
- Assign the Contributor built-in role
- Assign the Reader built-in role
- Create the role assignment at the individual resource scope
Correct Answer: A
Correct Answer
Answer A is correct because Storage Blob Data Reader includes blob data-plane read permissions, unlike the generic Reader role that primarily reads resource configuration. The A. Datum scenario specifically requires that the user must read blob data contents rather than only the storage account configuration, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. For A. Datum, that does not satisfy the requirement that the user must read blob data contents rather than only the storage account configuration; it solves a different administrative need.
Answer C is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. In A. Datum, this is not sufficient because the user must read blob data contents rather than only the storage account configuration; the capability addresses a neighboring use case.
Answer D is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. Applied to A. Datum, this does not provide the required behavior because the user must read blob data contents rather than only the storage account configuration.
Question 14
Contoso creates a custom role that must be assignable only within Subscription-A and its descendants. Which role-definition property should be configured? Choose ONE.
- Use Access control (IAM) at the required scope and add a role assignment
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Create the role assignment at management-group scope
- Identify the principal, role definition, and scope for the assignment
Correct Answer: B
Correct Answer
Answer B is correct because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. Applied to Contoso, the capability meets the requirement that the custom role definition should only be available for assignment in a defined hierarchy without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. In Contoso, this is not sufficient because the custom role definition should only be available for assignment in a defined hierarchy; the capability addresses a neighboring use case.
Answer C is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. For Contoso, that does not satisfy the requirement that the custom role definition should only be available for assignment in a defined hierarchy; it solves a different administrative need.
Answer D is incorrect because An Azure role assignment connects a security principal to a role definition at a specific scope; all three elements determine the resulting authorization. The Contoso scenario instead requires that the custom role definition should only be available for assignment in a defined hierarchy, so this option would leave the key requirement unresolved.
Question 15
Fabrikam wants a custom role available in one management-group hierarchy but not tenant-wide. What should it restrict? Choose ONE.
- Identify the principal, role definition, and scope for the assignment
- Use Access control (IAM) at the required scope and add a role assignment
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Create the role assignment at management-group scope
Correct Answer: C
Correct Answer
Answer C is correct because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. For Fabrikam, that directly satisfies the requirement that the custom role definition should only be available for assignment in a defined hierarchy.
Incorrect Answers
Answer A is incorrect because An Azure role assignment connects a security principal to a role definition at a specific scope; all three elements determine the resulting authorization. In Fabrikam, this is not sufficient because the custom role definition should only be available for assignment in a defined hierarchy; the capability addresses a neighboring use case.
Answer B is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. The Fabrikam scenario instead requires that the custom role definition should only be available for assignment in a defined hierarchy, so this option would leave the key requirement unresolved.
Answer D is incorrect because Management-group scope can apply an Azure RBAC assignment across child subscriptions and their resources through inheritance. Applied to Fabrikam, this does not provide the required behavior because the custom role definition should only be available for assignment in a defined hierarchy.
Question 16
Northwind sees no direct role assignment on a VM, yet a user can read it. What should the administrator inspect when interpreting the user’s access? Choose ONE.
- Use Access control (IAM) at the required scope and add a role assignment
- Remove the Azure role assignment that grants the access
- Create the role assignment at the individual resource scope
- Review role assignments including inherited parent-scope assignments
Correct Answer: D
Correct Answer
Answer D is correct because Access at a child resource can come from a direct assignment or from a parent scope, so inherited assignments must be included when interpreting effective access. In the northwind sees no direct case, this is the best fit because effective access at a child resource may have been granted from a parent scope and must be included in the review.
Incorrect Answers
Answer A is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. For the northwind sees no direct case, that does not satisfy the requirement that effective access at a child resource may have been granted from a parent scope and must be included in the review; it solves a different administrative need.
Answer B is incorrect because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. Applied to the northwind sees no direct case, this does not provide the required behavior because effective access at a child resource may have been granted from a parent scope and must be included in the review.
Answer C is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. The the northwind sees no direct case scenario instead requires that effective access at a child resource may have been granted from a parent scope and must be included in the review, so this option would leave the key requirement unresolved.
Question 17
Adventure Works investigates why a user has access to a storage account even though no direct assignment exists there. What should it review? Choose ONE.
- Review role assignments including inherited parent-scope assignments
- Remove the Azure role assignment that grants the access
- Create the role assignment at the individual resource scope
- Use Access control (IAM) at the required scope and add a role assignment
Correct Answer: A
Correct Answer
Answer A is correct because Access at a child resource can come from a direct assignment or from a parent scope, so inherited assignments must be included when interpreting effective access. The Adventure Works scenario specifically requires that effective access at a child resource may have been granted from a parent scope and must be included in the review, so this choice matches the intended behavior.
Incorrect Answers
Answer B is incorrect because Azure RBAC access is granted by role assignments; removing the relevant assignment revokes that grant without deleting the identity. For Adventure Works, that does not satisfy the requirement that effective access at a child resource may have been granted from a parent scope and must be included in the review; it solves a different administrative need.
Answer C is incorrect because Resource scope is the narrowest standard Azure RBAC scope and is preferred when access is needed to only one resource. In Adventure Works, this is not sufficient because effective access at a child resource may have been granted from a parent scope and must be included in the review; the capability addresses a neighboring use case.
Answer D is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. Applied to Adventure Works, this does not provide the required behavior because effective access at a child resource may have been granted from a parent scope and must be included in the review.
Question 18
Tailspin documents an Azure RBAC grant and needs the three elements that determine the authorization. Which model should it record? Choose ONE.
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Identify the principal, role definition, and scope for the assignment
- Assign the Reader built-in role
- Use Access control (IAM) at the required scope and add a role assignment
Correct Answer: B
Correct Answer
Answer B is correct because An Azure role assignment connects a security principal to a role definition at a specific scope; all three elements determine the resulting authorization. Applied to the tailspin documents an azure case, the capability meets the requirement that the administrator must reason about who receives permissions, which permissions apply, and where they apply without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. In the tailspin documents an azure case, this is not sufficient because the administrator must reason about who receives permissions, which permissions apply, and where they apply; the capability addresses a neighboring use case.
Answer C is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. The the tailspin documents an azure case scenario instead requires that the administrator must reason about who receives permissions, which permissions apply, and where they apply, so this option would leave the key requirement unresolved.
Answer D is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. For the tailspin documents an azure case, that does not satisfy the requirement that the administrator must reason about who receives permissions, which permissions apply, and where they apply; it solves a different administrative need.
Question 19
Woodgrove reviews a role assignment JSON and must identify the fields that explain the identity, permissions, and target boundary. Which concept is being interpreted? Choose ONE.
- Use Access control (IAM) at the required scope and add a role assignment
- Set the custom role AssignableScopes to the intended management group, subscription, or resource-group hierarchy
- Identify the principal, role definition, and scope for the assignment
- Assign the Reader built-in role
Correct Answer: C
Correct Answer
Answer C is correct because An Azure role assignment connects a security principal to a role definition at a specific scope; all three elements determine the resulting authorization. For the woodgrove reviews a role case, that directly satisfies the requirement that the administrator must reason about who receives permissions, which permissions apply, and where they apply.
Incorrect Answers
Answer A is incorrect because Access control (IAM) is the standard Azure portal surface for viewing and creating Azure RBAC role assignments at a selected scope. Applied to the woodgrove reviews a role case, this does not provide the required behavior because the administrator must reason about who receives permissions, which permissions apply, and where they apply.
Answer B is incorrect because AssignableScopes controls where a custom role definition is available to be assigned; it does not itself grant the role to a principal. The the woodgrove reviews a role case scenario instead requires that the administrator must reason about who receives permissions, which permissions apply, and where they apply, so this option would leave the key requirement unresolved.
Answer D is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. In the woodgrove reviews a role case, this is not sufficient because the administrator must reason about who receives permissions, which permissions apply, and where they apply; the capability addresses a neighboring use case.
Question 20
A team needs to manage Azure role assignments without broad workload administration. Which TWO built-in roles are specifically suitable for access administration? Choose TWO.
- Assign Storage Blob Data Reader at the blob-data scope
- Assign the User Access Administrator built-in role
- Assign the Reader built-in role
- Assign the Contributor built-in role
- Assign the Role Based Access Control Administrator built-in role
Correct Answers: B, E
Correct Answers
Answer B is correct because User Access Administrator is focused on managing user access to Azure resources and can create or remove Azure role assignments. In the a team needs to case, this is the best fit because access administration should be delegated through roles intended to manage role assignments.
Answer E is correct because Role Based Access Control Administrator can manage Azure RBAC role assignments without granting broad resource-management permissions. The the a team needs to case scenario specifically requires that access administration should be delegated through roles intended to manage role assignments, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Storage Blob Data Reader includes blob data-plane read permissions, unlike the generic Reader role that primarily reads resource configuration. In the a team needs to case, this is not sufficient because access administration should be delegated through roles intended to manage role assignments; the capability addresses a neighboring use case.
Answer C is incorrect because Reader provides management-plane read access to Azure resources without granting modification rights or data-plane access by itself. For the a team needs to case, that does not satisfy the requirement that access administration should be delegated through roles intended to manage role assignments; it solves a different administrative need.
Answer D is incorrect because Contributor can create and manage Azure resources but cannot grant access by creating Azure RBAC role assignments. Applied to the a team needs to case, this does not provide the required behavior because access administration should be delegated through roles intended to manage role assignments.
