nerdexam
Microsoft

AZ-500 · Question #232

Hotspot Question You have the hierarchy of Azure resources shown in the following exhibit. RG1, RG2, and RG3 are resource groups. RG2 contains a virtual machine named VM1. You assign role-based…

The correct answer is User1 can deploy virtual machines to RG1. = Yes; User2 can delete VM2. = Yes; User3 can reset the password of the built-in Administrator account of VM2. = No. User1 has the Contributor role at the Subscription level, which inherits down to all resource groups including RG1, allowing them to deploy virtual machines. User2 has the Owner role on RG2 (which contains VM2) or at a scope that includes VM2, granting full control including…

Submitted by olafpl· Mar 6, 2026Manage identity and access in Azure - specifically understanding RBAC role assignments, scope inheritance (Management Group → Subscription → Resource Group → Resource), and the permissions granted by built-in roles such as Owner, Contributor, and Reader.

Question

Hotspot Question You have the hierarchy of Azure resources shown in the following exhibit. RG1, RG2, and RG3 are resource groups. RG2 contains a virtual machine named VM1. You assign role-based access control (RBAC) roles to the users shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #232 exhibit 1
AZ-500 question #232 exhibit 2
AZ-500 question #232 exhibit 3
AZ-500 question #232 exhibit 4

Answer Area

  • User1 can deploy virtual machines to RG1.Yes
  • User2 can delete VM2.Yes
  • User3 can reset the password of the built-in Administrator account of VM2.No

Explanation

User1 has the Contributor role at the Subscription level, which inherits down to all resource groups including RG1, allowing them to deploy virtual machines. User2 has the Owner role on RG2 (which contains VM2) or at a scope that includes VM2, granting full control including the ability to delete VM2. User3 likely has a read-only or limited role (such as Reader or a scope-limited Contributor) that does not include the 'Microsoft.Compute/virtualMachines/resetVMPassword' action or equivalent administrative VM operations, so resetting the built-in Administrator password is not permitted.

Topics

#Azure RBAC#Role Inheritance#Identity and Access Management#Azure Resource Groups

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice