Manage Access to Azure Resources AZ-104 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A user is assigned the Contributor role at the subscription scope and the Reader role at the resource group 'RG1' scope. What is the user's effective permission on a resource in 'RG1'?

   • ANo access to the resource because the Reader role at RG1 is more specific.
   • BFull management access to the resource.
   • CFull management access only if the user is also assigned the Contributor role at RG1.
   • DRead-only access to the resource.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which built-in Azure role grants full access to manage all resources in a subscription, including the ability to assign roles in Azure RBAC?

   • AOwner
   • BContributor
   • CUser Access Administrator
   • DReader
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a valid scope for an Azure RBAC role assignment?

   • AResource group
   • BAvailability set
   • CStorage account
   • DVirtual network
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user reports they can create virtual machines in the 'Prod-RG' resource group but cannot delete them. You check the role assignments and find the user is a member of the 'VM Operators' group, which has the Virtual Machine Contributor role assigned at the resource group scope. The user is also individually assigned the Reader role at the subscription scope. What is the most likely reason the user cannot delete virtual machines?

   • AThe user's effective permissions are the union of all role assignments, but the delete action may be denied by a specific 'Deny' assignment or the user may lack permission to delete the underlying resources like the NIC or disk.
   • BThe user needs the Owner role at the resource group scope to delete virtual machines.
   • CThe Virtual Machine Contributor role does not include the permission to delete virtual machines.
   • DThe Reader role assignment at the subscription scope overrides the Virtual Machine Contributor role at the resource group scope.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   You need to grant a user read-only access to a single virtual machine. At which scope should you assign the Reader role to achieve the least privilege?

   • AResource
   • BResource group
   • CManagement group
   • DSubscription
   Reveal Solution Discussion Select an answer first