Microsoft AZ-104 Azure RBAC Practice Test

 

Topic 02 focuses on Azure RBAC Roles, Scopes, and Access Assignments for the Microsoft Certified: Azure Administrator Associate certification and the AZ-104 exam, using Microsoft Azure administration scenarios. For broader exam preparation, review the Microsoft Azure Administrator AZ-104 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

To give a principal full resource management plus role-assignment capability, which Azure configuration should be selected?

1. User Access Administrator role
2. Role assignment
3. Contributor role
4. Owner role

Correct Answer: D

 

Correct Answer

Answer D is correct because Owner role is a built-in Azure role that grants full management access to resources and can also assign Azure roles. It directly supports the requirement to give a principal full resource management plus role-assignment capability.

Incorrect Answers

Answer A is incorrect because User Access Administrator role is used to delegate Azure RBAC access administration without granting full resource-management permissions; it does not provide the capability described in the scenario.

Answer B is incorrect because Role assignment is used to grant a user, group, service principal, or managed identity a role at a selected scope; it does not provide the capability described in the scenario.

Answer C is incorrect because Contributor role is used to let an administrator manage resources without delegating permissions to others; it does not provide the capability described in the scenario.

 

Question 2

For Owner role, which administrative outcome is expected?

1. Identify the identity that receives permissions from an Azure RBAC assignment
2. Grant the minimum required access when only a single resource should be affected
3. Grant permissions broadly across a subscription without applying them to unrelated subscriptions
4. Give a principal full resource management plus role-assignment capability

Correct Answer: D

 

Correct Answer

Answer D is correct because Owner role is a built-in Azure role that grants full management access to resources and can also assign Azure roles. Its intended administrative use is to give a principal full resource management plus role-assignment capability.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Security principal, which is used to identify the identity that receives permissions from an Azure RBAC assignment; it is not the primary purpose of Owner role.

Answer B is incorrect because that outcome belongs to Resource scope, which is used to grant the minimum required access when only a single resource should be affected; it is not the primary purpose of Owner role.

Answer C is incorrect because that outcome belongs to Subscription scope, which is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it is not the primary purpose of Owner role.

 

Question 3

To let an administrator manage resources without delegating permissions to others, which Azure configuration should be selected?

1. Subscription scope
2. Contributor role
3. Reader role
4. Owner role

Correct Answer: B

 

Correct Answer

Answer B is correct because Contributor role is a built-in Azure role that can create and manage resources but cannot grant access by creating Azure role assignments. It directly supports the requirement to let an administrator manage resources without delegating permissions to others.

Incorrect Answers

Answer A is incorrect because Subscription scope is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it does not provide the capability described in the scenario.

Answer C is incorrect because Reader role is used to provide read-only visibility to Azure resources; it does not provide the capability described in the scenario.

Answer D is incorrect because Owner role is used to give a principal full resource management plus role-assignment capability; it does not provide the capability described in the scenario.

 

Question 4

For Contributor role, which administrative outcome is expected?

1. Grant permissions across a related set of resources without covering the whole subscription
2. Grant a user, group, service principal, or managed identity a role at a selected scope
3. Grant the minimum required access when only a single resource should be affected
4. Let an administrator manage resources without delegating permissions to others

Correct Answer: D

 

Correct Answer

Answer D is correct because Contributor role is a built-in Azure role that can create and manage resources but cannot grant access by creating Azure role assignments. Its intended administrative use is to let an administrator manage resources without delegating permissions to others.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Resource group scope, which is used to grant permissions across a related set of resources without covering the whole subscription; it is not the primary purpose of Contributor role.

Answer B is incorrect because that outcome belongs to Role assignment, which is used to grant a user, group, service principal, or managed identity a role at a selected scope; it is not the primary purpose of Contributor role.

Answer C is incorrect because that outcome belongs to Resource scope, which is used to grant the minimum required access when only a single resource should be affected; it is not the primary purpose of Contributor role.

 

Question 5

To provide read-only visibility to Azure resources, which Azure configuration should be selected?

1. Reader role
2. Security principal
3. Resource scope
4. Resource group scope

Correct Answer: A

 

Correct Answer

Answer A is correct because Reader role is a built-in Azure role that can view existing resources but cannot make changes. It directly supports the requirement to provide read-only visibility to Azure resources.

Incorrect Answers

Answer B is incorrect because Security principal is used to identify the identity that receives permissions from an Azure RBAC assignment; it does not provide the capability described in the scenario.

Answer C is incorrect because Resource scope is used to grant the minimum required access when only a single resource should be affected; it does not provide the capability described in the scenario.

Answer D is incorrect because Resource group scope is used to grant permissions across a related set of resources without covering the whole subscription; it does not provide the capability described in the scenario.

 

Question 6

For Reader role, which administrative outcome is expected?

1. Grant the minimum required access when only a single resource should be affected
2. Provide read-only visibility to Azure resources
3. Grant permissions broadly across a subscription without applying them to unrelated subscriptions
4. Grant a user, group, service principal, or managed identity a role at a selected scope

Correct Answer: B

 

Correct Answer

Answer B is correct because Reader role is a built-in Azure role that can view existing resources but cannot make changes. Its intended administrative use is to provide read-only visibility to Azure resources.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Resource scope, which is used to grant the minimum required access when only a single resource should be affected; it is not the primary purpose of Reader role.

Answer C is incorrect because that outcome belongs to Subscription scope, which is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it is not the primary purpose of Reader role.

Answer D is incorrect because that outcome belongs to Role assignment, which is used to grant a user, group, service principal, or managed identity a role at a selected scope; it is not the primary purpose of Reader role.

 

Question 7

To delegate Azure RBAC access administration without granting full resource-management permissions, which Azure configuration should be selected?

1. Owner role
2. User Access Administrator role
3. Management group scope
4. Resource group scope

Correct Answer: B

 

Correct Answer

Answer B is correct because User Access Administrator role is a built-in role focused on managing user access to Azure resources through role assignments. It directly supports the requirement to delegate Azure RBAC access administration without granting full resource-management permissions.

Incorrect Answers

Answer A is incorrect because Owner role is used to give a principal full resource management plus role-assignment capability; it does not provide the capability described in the scenario.

Answer C is incorrect because Management group scope is used to apply access that can be inherited by multiple subscriptions organized beneath a management group; it does not provide the capability described in the scenario.

Answer D is incorrect because Resource group scope is used to grant permissions across a related set of resources without covering the whole subscription; it does not provide the capability described in the scenario.

 

Question 8

For User Access Administrator role, which administrative outcome is expected?

1. Provide access to descendants without creating a separate role assignment on every child resource
2. Provide read-only visibility to Azure resources
3. Delegate Azure RBAC access administration without granting full resource-management permissions
4. Let an administrator manage resources without delegating permissions to others

Correct Answer: C

 

Correct Answer

Answer C is correct because User Access Administrator role is a built-in role focused on managing user access to Azure resources through role assignments. Its intended administrative use is to delegate Azure RBAC access administration without granting full resource-management permissions.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Inherited role assignment, which is used to provide access to descendants without creating a separate role assignment on every child resource; it is not the primary purpose of User Access Administrator role.

Answer B is incorrect because that outcome belongs to Reader role, which is used to provide read-only visibility to Azure resources; it is not the primary purpose of User Access Administrator role.

Answer D is incorrect because that outcome belongs to Contributor role, which is used to let an administrator manage resources without delegating permissions to others; it is not the primary purpose of User Access Administrator role.

 

Question 9

To define the permissions represented by an Azure RBAC role, which Azure configuration should be selected?

1. Role definition
2. Reader role
3. Owner role
4. Role assignment

Correct Answer: A

 

Correct Answer

Answer A is correct because Role definition is the collection of allowed and excluded management or data actions that describes what an Azure role can do. It directly supports the requirement to define the permissions represented by an Azure RBAC role.

Incorrect Answers

Answer B is incorrect because Reader role is used to provide read-only visibility to Azure resources; it does not provide the capability described in the scenario.

Answer C is incorrect because Owner role is used to give a principal full resource management plus role-assignment capability; it does not provide the capability described in the scenario.

Answer D is incorrect because Role assignment is used to grant a user, group, service principal, or managed identity a role at a selected scope; it does not provide the capability described in the scenario.

 

Question 10

For Role definition, which administrative outcome is expected?

1. Give a principal full resource management plus role-assignment capability
2. Grant the minimum required access when only a single resource should be affected
3. Define the permissions represented by an Azure RBAC role
4. Let an administrator manage resources without delegating permissions to others

Correct Answer: C

 

Correct Answer

Answer C is correct because Role definition is the collection of allowed and excluded management or data actions that describes what an Azure role can do. Its intended administrative use is to define the permissions represented by an Azure RBAC role.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Owner role, which is used to give a principal full resource management plus role-assignment capability; it is not the primary purpose of Role definition.

Answer B is incorrect because that outcome belongs to Resource scope, which is used to grant the minimum required access when only a single resource should be affected; it is not the primary purpose of Role definition.

Answer D is incorrect because that outcome belongs to Contributor role, which is used to let an administrator manage resources without delegating permissions to others; it is not the primary purpose of Role definition.

 

Question 11

To grant a user, group, service principal, or managed identity a role at a selected scope, which Azure configuration should be selected?

1. Subscription scope
2. Owner role
3. Resource scope
4. Role assignment

Correct Answer: D

 

Correct Answer

Answer D is correct because Role assignment is the association of a role definition with a security principal at a particular Azure scope. It directly supports the requirement to grant a user, group, service principal, or managed identity a role at a selected scope.

Incorrect Answers

Answer A is incorrect because Subscription scope is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it does not provide the capability described in the scenario.

Answer B is incorrect because Owner role is used to give a principal full resource management plus role-assignment capability; it does not provide the capability described in the scenario.

Answer C is incorrect because Resource scope is used to grant the minimum required access when only a single resource should be affected; it does not provide the capability described in the scenario.

 

Question 12

For Role assignment, which administrative outcome is expected?

1. Grant permissions broadly across a subscription without applying them to unrelated subscriptions
2. Identify the identity that receives permissions from an Azure RBAC assignment
3. Grant a user, group, service principal, or managed identity a role at a selected scope
4. Define the permissions represented by an Azure RBAC role

Correct Answer: C

 

Correct Answer

Answer C is correct because Role assignment is the association of a role definition with a security principal at a particular Azure scope. Its intended administrative use is to grant a user, group, service principal, or managed identity a role at a selected scope.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Subscription scope, which is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it is not the primary purpose of Role assignment.

Answer B is incorrect because that outcome belongs to Security principal, which is used to identify the identity that receives permissions from an Azure RBAC assignment; it is not the primary purpose of Role assignment.

Answer D is incorrect because that outcome belongs to Role definition, which is used to define the permissions represented by an Azure RBAC role; it is not the primary purpose of Role assignment.

 

Question 13

To identify the identity that receives permissions from an Azure RBAC assignment, which Azure configuration should be selected?

1. User Access Administrator role
2. Security principal
3. Resource scope
4. Resource group scope

Correct Answer: B

 

Correct Answer

Answer B is correct because Security principal is the user, group, service principal, or managed identity to which an Azure role can be assigned. It directly supports the requirement to identify the identity that receives permissions from an Azure RBAC assignment.

Incorrect Answers

Answer A is incorrect because User Access Administrator role is used to delegate Azure RBAC access administration without granting full resource-management permissions; it does not provide the capability described in the scenario.

Answer C is incorrect because Resource scope is used to grant the minimum required access when only a single resource should be affected; it does not provide the capability described in the scenario.

Answer D is incorrect because Resource group scope is used to grant permissions across a related set of resources without covering the whole subscription; it does not provide the capability described in the scenario.

 

Question 14

For Security principal, which administrative outcome is expected?

1. Let an administrator manage resources without delegating permissions to others
2. Provide access to descendants without creating a separate role assignment on every child resource
3. Identify the identity that receives permissions from an Azure RBAC assignment
4. Define the permissions represented by an Azure RBAC role

Correct Answer: C

 

Correct Answer

Answer C is correct because Security principal is the user, group, service principal, or managed identity to which an Azure role can be assigned. Its intended administrative use is to identify the identity that receives permissions from an Azure RBAC assignment.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Contributor role, which is used to let an administrator manage resources without delegating permissions to others; it is not the primary purpose of Security principal.

Answer B is incorrect because that outcome belongs to Inherited role assignment, which is used to provide access to descendants without creating a separate role assignment on every child resource; it is not the primary purpose of Security principal.

Answer D is incorrect because that outcome belongs to Role definition, which is used to define the permissions represented by an Azure RBAC role; it is not the primary purpose of Security principal.

 

Question 15

To apply access that can be inherited by multiple subscriptions organized beneath a management group, which Azure configuration should be selected?

1. Inherited role assignment
2. Role assignment
3. Resource group scope
4. Management group scope

Correct Answer: D

 

Correct Answer

Answer D is correct because Management group scope is an Azure RBAC scope above subscriptions in the resource hierarchy. It directly supports the requirement to apply access that can be inherited by multiple subscriptions organized beneath a management group.

Incorrect Answers

Answer A is incorrect because Inherited role assignment is used to provide access to descendants without creating a separate role assignment on every child resource; it does not provide the capability described in the scenario.

Answer B is incorrect because Role assignment is used to grant a user, group, service principal, or managed identity a role at a selected scope; it does not provide the capability described in the scenario.

Answer C is incorrect because Resource group scope is used to grant permissions across a related set of resources without covering the whole subscription; it does not provide the capability described in the scenario.

 

Question 16

For Management group scope, which administrative outcome is expected?

1. Delegate Azure RBAC access administration without granting full resource-management permissions
2. Apply access that can be inherited by multiple subscriptions organized beneath a management group
3. Grant permissions across a related set of resources without covering the whole subscription
4. Grant the minimum required access when only a single resource should be affected

Correct Answer: B

 

Correct Answer

Answer B is correct because Management group scope is an Azure RBAC scope above subscriptions in the resource hierarchy. Its intended administrative use is to apply access that can be inherited by multiple subscriptions organized beneath a management group.

Incorrect Answers

Answer A is incorrect because that outcome belongs to User Access Administrator role, which is used to delegate Azure RBAC access administration without granting full resource-management permissions; it is not the primary purpose of Management group scope.

Answer C is incorrect because that outcome belongs to Resource group scope, which is used to grant permissions across a related set of resources without covering the whole subscription; it is not the primary purpose of Management group scope.

Answer D is incorrect because that outcome belongs to Resource scope, which is used to grant the minimum required access when only a single resource should be affected; it is not the primary purpose of Management group scope.

 

Question 17

To grant permissions broadly across a subscription without applying them to unrelated subscriptions, which Azure configuration should be selected?

1. Inherited role assignment
2. Security principal
3. Contributor role
4. Subscription scope

Correct Answer: D

 

Correct Answer

Answer D is correct because Subscription scope is an Azure RBAC scope that covers resource groups and resources within one subscription. It directly supports the requirement to grant permissions broadly across a subscription without applying them to unrelated subscriptions.

Incorrect Answers

Answer A is incorrect because Inherited role assignment is used to provide access to descendants without creating a separate role assignment on every child resource; it does not provide the capability described in the scenario.

Answer B is incorrect because Security principal is used to identify the identity that receives permissions from an Azure RBAC assignment; it does not provide the capability described in the scenario.

Answer C is incorrect because Contributor role is used to let an administrator manage resources without delegating permissions to others; it does not provide the capability described in the scenario.

 

Question 18

For Subscription scope, which administrative outcome is expected?

1. Grant permissions broadly across a subscription without applying them to unrelated subscriptions
2. Apply access that can be inherited by multiple subscriptions organized beneath a management group
3. Grant permissions across a related set of resources without covering the whole subscription
4. Identify the identity that receives permissions from an Azure RBAC assignment

Correct Answer: A

 

Correct Answer

Answer A is correct because Subscription scope is an Azure RBAC scope that covers resource groups and resources within one subscription. Its intended administrative use is to grant permissions broadly across a subscription without applying them to unrelated subscriptions.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Management group scope, which is used to apply access that can be inherited by multiple subscriptions organized beneath a management group; it is not the primary purpose of Subscription scope.

Answer C is incorrect because that outcome belongs to Resource group scope, which is used to grant permissions across a related set of resources without covering the whole subscription; it is not the primary purpose of Subscription scope.

Answer D is incorrect because that outcome belongs to Security principal, which is used to identify the identity that receives permissions from an Azure RBAC assignment; it is not the primary purpose of Subscription scope.

 

Question 19

To grant permissions across a related set of resources without covering the whole subscription, which Azure configuration should be selected?

1. Contributor role
2. Inherited role assignment
3. Resource group scope
4. Security principal

Correct Answer: C

 

Correct Answer

Answer C is correct because Resource group scope is an Azure RBAC scope that applies to resources contained in one resource group. It directly supports the requirement to grant permissions across a related set of resources without covering the whole subscription.

Incorrect Answers

Answer A is incorrect because Contributor role is used to let an administrator manage resources without delegating permissions to others; it does not provide the capability described in the scenario.

Answer B is incorrect because Inherited role assignment is used to provide access to descendants without creating a separate role assignment on every child resource; it does not provide the capability described in the scenario.

Answer D is incorrect because Security principal is used to identify the identity that receives permissions from an Azure RBAC assignment; it does not provide the capability described in the scenario.

 

Question 20

For Resource group scope, which administrative outcome is expected?

1. Grant permissions across a related set of resources without covering the whole subscription
2. Provide access to descendants without creating a separate role assignment on every child resource
3. Give a principal full resource management plus role-assignment capability
4. Grant a user, group, service principal, or managed identity a role at a selected scope

Correct Answer: A

 

Correct Answer

Answer A is correct because Resource group scope is an Azure RBAC scope that applies to resources contained in one resource group. Its intended administrative use is to grant permissions across a related set of resources without covering the whole subscription.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Inherited role assignment, which is used to provide access to descendants without creating a separate role assignment on every child resource; it is not the primary purpose of Resource group scope.

Answer C is incorrect because that outcome belongs to Owner role, which is used to give a principal full resource management plus role-assignment capability; it is not the primary purpose of Resource group scope.

Answer D is incorrect because that outcome belongs to Role assignment, which is used to grant a user, group, service principal, or managed identity a role at a selected scope; it is not the primary purpose of Resource group scope.

 

Question 21

To grant the minimum required access when only a single resource should be affected, which Azure configuration should be selected?

1. Role definition
2. Resource scope
3. Subscription scope
4. Contributor role

Correct Answer: B

 

Correct Answer

Answer B is correct because Resource scope is the narrowest common Azure RBAC scope, applying a role assignment to one resource. It directly supports the requirement to grant the minimum required access when only a single resource should be affected.

Incorrect Answers

Answer A is incorrect because Role definition is used to define the permissions represented by an Azure RBAC role; it does not provide the capability described in the scenario.

Answer C is incorrect because Subscription scope is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it does not provide the capability described in the scenario.

Answer D is incorrect because Contributor role is used to let an administrator manage resources without delegating permissions to others; it does not provide the capability described in the scenario.

 

Question 22

For Resource scope, which administrative outcome is expected?

1. Grant the minimum required access when only a single resource should be affected
2. Grant permissions broadly across a subscription without applying them to unrelated subscriptions
3. Identify the identity that receives permissions from an Azure RBAC assignment
4. Grant permissions across a related set of resources without covering the whole subscription

Correct Answer: A

 

Correct Answer

Answer A is correct because Resource scope is the narrowest common Azure RBAC scope, applying a role assignment to one resource. Its intended administrative use is to grant the minimum required access when only a single resource should be affected.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Subscription scope, which is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it is not the primary purpose of Resource scope.

Answer C is incorrect because that outcome belongs to Security principal, which is used to identify the identity that receives permissions from an Azure RBAC assignment; it is not the primary purpose of Resource scope.

Answer D is incorrect because that outcome belongs to Resource group scope, which is used to grant permissions across a related set of resources without covering the whole subscription; it is not the primary purpose of Resource scope.

 

Question 23

To provide access to descendants without creating a separate role assignment on every child resource, which Azure configuration should be selected?

1. Inherited role assignment
2. Resource scope
3. Reader role
4. Subscription scope

Correct Answer: A

 

Correct Answer

Answer A is correct because Inherited role assignment is an Azure RBAC assignment made at a parent scope that is effective at child scopes. It directly supports the requirement to provide access to descendants without creating a separate role assignment on every child resource.

Incorrect Answers

Answer B is incorrect because Resource scope is used to grant the minimum required access when only a single resource should be affected; it does not provide the capability described in the scenario.

Answer C is incorrect because Reader role is used to provide read-only visibility to Azure resources; it does not provide the capability described in the scenario.

Answer D is incorrect because Subscription scope is used to grant permissions broadly across a subscription without applying them to unrelated subscriptions; it does not provide the capability described in the scenario.

 

Question 24

For Inherited role assignment, which administrative outcome is expected?

1. Delegate Azure RBAC access administration without granting full resource-management permissions
2. Identify the identity that receives permissions from an Azure RBAC assignment
3. Provide access to descendants without creating a separate role assignment on every child resource
4. Grant a user, group, service principal, or managed identity a role at a selected scope

Correct Answer: C

 

Correct Answer

Answer C is correct because Inherited role assignment is an Azure RBAC assignment made at a parent scope that is effective at child scopes. Its intended administrative use is to provide access to descendants without creating a separate role assignment on every child resource.

Incorrect Answers

Answer A is incorrect because that outcome belongs to User Access Administrator role, which is used to delegate Azure RBAC access administration without granting full resource-management permissions; it is not the primary purpose of Inherited role assignment.

Answer B is incorrect because that outcome belongs to Security principal, which is used to identify the identity that receives permissions from an Azure RBAC assignment; it is not the primary purpose of Inherited role assignment.

Answer D is incorrect because that outcome belongs to Role assignment, which is used to grant a user, group, service principal, or managed identity a role at a selected scope; it is not the primary purpose of Inherited role assignment.