Hotspot Question You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create an Azure role by using the following JSON file. You assign…

Question

Exhibits

Answer Area

• User1 can create a new virtual machine in RG1.Yes
• User can modify the properties of storage1.No
• User1 can attach the network interface of VM1 to VNET1.No

Explanation

Role1 is a custom Azure role with 'Microsoft.Compute/virtualMachines/' and 'Microsoft.Network/virtualNetworks/' actions granted, scoped to RG1. User1 can create a new VM in RG1 because the wildcard on Microsoft.Compute/virtualMachines/* allows all compute operations including create. User1 cannot modify storage1 because the role grants no storage permissions (Microsoft.Storage/* is not included), and storage1 may also be outside RG1's scope. User1 cannot attach a network interface of VM1 to VNET1 because while the role includes virtualNetworks/, attaching a NIC to a VM requires 'Microsoft.Compute/virtualMachines/write' AND 'Microsoft.Network/networkInterfaces/' permissions - the latter is not explicitly granted, and VNET1 may reside in a different resource group (VNETs are often in separate RGs), placing it outside the Role1 assignment scope of RG1.

No community discussion yet for this question.