nerdexam
Microsoft

AZ-500 · Question #113

Drag and Drop Question You have an Azure subscription named Sub1. You have an Azure Active Directory (Azure AD) group named Group1 that contains all the members of your IT team. You need to ensure…

The correct answer is Create a JSON file.; Run the New-AzureRmRoleDefinition cmdlet.; Run the New-AzureRmRoleAssignment cmdlet. To grant least-privilege access for VM operations (stop, start, restart), you must create a custom RBAC role. First, you create a JSON file that defines the custom role with only the necessary permissions (Microsoft.Compute/virtualMachines/start/action, stop/action…

Submitted by the_admin· Mar 6, 2026Manage identity and access – specifically implementing role-based access control (RBAC) with custom roles to enforce least privilege for resource operations in Azure (AZ-104 / AZ-500 domain: Manage Access Control)

Question

Drag and Drop Question You have an Azure subscription named Sub1. You have an Azure Active Directory (Azure AD) group named Group1 that contains all the members of your IT team. You need to ensure that the members of Group1 can stop, start, and restart the Azure virtual machines in Sub1. The solution must use the principle of least privilege. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibit

AZ-500 question #113 exhibit

Answer Area

Drag items

Create a JSON file.Run the Update-AzureRmManagementGroup cmdlet.Create an XML file.Run the New-AzureRmRoleDefinition cmdlet.Run the New-AzureRmRoleAssignment cmdlet.

Correct arrangement

  • Create a JSON file.
  • Run the New-AzureRmRoleDefinition cmdlet.
  • Run the New-AzureRmRoleAssignment cmdlet.

Explanation

To grant least-privilege access for VM operations (stop, start, restart), you must create a custom RBAC role. First, you create a JSON file that defines the custom role with only the necessary permissions (Microsoft.Compute/virtualMachines/start/action, stop/action, restart/action). Then you run New-AzureRmRoleDefinition to register that custom role definition in Azure using the JSON file. Finally, you run New-AzureRmRoleAssignment to assign the newly created custom role to Group1 at the Sub1 subscription scope.

Topics

#Azure RBAC#Custom Role Definitions#Least Privilege#Azure Virtual Machines

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice