Case Study 5 - Contoso, Ltd Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing…

The correct interaction assigns User1 the 'Resource Policy Contributor for Sub1' role and User4 the 'Resource Policy Contributor for RG2' role to manage Azure Policies according to the principle of least privilege, assuming their tasks involve policy management.

Submitted by wei.xz· Mar 4, 2026Manage Azure identities and governance

Question

Case Study 5 - Contoso, Ltd Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. Create a storage account named storage5 and configure storage replication for the Blob service. Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. Associate NSG1 to the network interface of VM1. Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: Create container1 and share1. Use the principle of least privilege. Create an Azure AD security group named Group4. Back up the Azure file shares and virtual machines by using Azure Backup. Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. Hotspot Question You need to ensure that User1 can create initiative definitions, and User4 can assign initiatives to RG2. The solution must meet the technical requirements. Which role should you assign to each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

User1:
Contributor for RG1Contributor for Sub1Security Admin for RG1Resource Policy Contributor for Sub1
User4:
Contributor for RG2Contributor for Sub1Security Admin for Sub1Resource Policy Contributor for RG2

Explanation

Approach. The core of this question, inferred from the correct answers, is assigning appropriate Azure roles based on the principle of least privilege, specifically for managing Azure Policies. Although the provided case study snippet states 'User1 manages the resources in RG1' and 'User4 manages the resources in RG2', the highlighted correct roles are 'Resource Policy Contributor'. This strongly implies that the actual question or a preceding section of the case study requires these users to manage Azure Policies, not just general resources.

For User1: The case study states User1 manages resources in RG1. If User1's responsibility includes managing Azure Policies that might apply across the subscription (Sub1), assigning the 'Resource Policy Contributor for Sub1' role allows User1 to create, modify, and assign policy definitions, initiative definitions, and policy assignments at the subscription scope. This role is specifically for policy management.
For User4: The case study states User4 manages resources in RG2. To manage Azure Policies only within the scope of RG2, assigning 'Resource Policy Contributor for RG2' grants User4 the necessary permissions to define and assign policies within that specific resource group, adhering to the principle of least privilege by limiting their policy management scope to RG2.

Therefore, clicking on the dropdown for User1 and selecting 'Resource Policy Contributor for Sub1', and then clicking on the dropdown for User4 and selecting 'Resource Policy Contributor for RG2', correctly fulfills the implied requirement for policy management with appropriate scope.

Common mistakes.

common_mistake. Common mistakes stem from misunderstanding the specific permissions granted by each Azure built-in role and their appropriate scope, or from misinterpreting the implied requirement of the question (i.e., focusing on resource management instead of policy management):

Contributor for RG1/RG2/Sub1: The 'Contributor' role allows managing all types of resources (except assigning roles and managing blueprints) within its scope. If the requirement is specifically to manage policies, 'Contributor' is overly permissive as it grants broad resource management permissions. While User1 manages resources in RG1 and User4 in RG2, the selected 'Resource Policy Contributor' indicates the question is focused on policy tasks.
Security Admin for RG1/Sub1: This role is designed for managing security-related features, such as security policies in Azure Security Center, security alerts, and insights. It does not grant permissions to create or manage Azure Policy definitions or assignments, which is the function of the 'Resource Policy Contributor' role.
Assigning 'Resource Policy Contributor for RG2' to User1: This would be incorrect if User1 needs to manage policies across the entire subscription (Sub1), as it restricts their policy management scope to only RG2, which is contrary to the highlighted answer for User1.
Assigning 'Resource Policy Contributor for Sub1' to User4: This would be incorrect for User4 if their policy management responsibilities are confined to RG2. Granting subscription-wide policy contributor access when only RG2 access is needed violates the principle of least privilege.

Concept tested. Azure Role-Based Access Control (RBAC), understanding of specific Azure built-in roles (especially 'Resource Policy Contributor'), the principle of least privilege, and applying role assignments at appropriate scopes (Subscription vs. Resource Group).

Topics

#Azure AD Sync#Azure RBAC#Azure VNet#NSG Configuration

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice