Manage Access to Azure Resources AZ-104 Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A user needs to manage the access of other users to resources in a specific resource group, but should not be able to manage the resources themselves. Which built-in role should you assign at the resource group scope?

   • AOwner
   • BContributor
   • CUser Access Administrator
   • DReader
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   Your organization has a policy that requires using the principle of least privilege for all role assignments. A developer needs to deploy and manage resources in a specific resource group, but should not be able to modify access policies or assign roles. Which built-in role should you assign at the resource group scope?

   • AContributor
   • BOwner
   • CUser Access Administrator
   • DReader
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   You need to grant a user permission to manage virtual machines in a specific resource group. Which approach follows the principle of least privilege?

   • AAssign the Contributor role at the subscription scope.
   • BAssign the Owner role at the resource group scope.
   • CAssign the Virtual Machine Contributor role at the resource group scope.
   • DAssign the Reader role at the resource group scope.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A user is assigned the Contributor role at the subscription scope. What is the user's permission on a resource group within that subscription?

   • AReader, because the resource group overrides the subscription assignment
   • BNo access, because the role assignment is at a higher scope
   • COwner, because the subscription assignment grants full control
   • DContributor, because role assignments are inherited from the subscription to the resource group
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your company has a new Azure subscription. You need to grant a team of five developers the ability to manage all resources in the 'Dev' resource group, but they should not be able to grant access to other users. You also need to ensure that the developers can only manage resources in the 'Dev' resource group, not in other resource groups. What should you do?

   • ACreate a group, add the developers, and assign the Contributor role to the group at the 'Dev' resource group scope.
   • BAssign the Owner role to each developer at the 'Dev' resource group scope.
   • CAssign the Virtual Machine Contributor role to the group at the 'Dev' resource group scope.
   • DAssign the Contributor role to each developer at the subscription scope.
   Reveal Solution Discussion Select an answer first