You have an Azure subscription that contains the resources shown in the following table. You need to ensure that ServerAdmins can perform the following tasks: - Create virtual machines in RG1 only…

Question

Exhibits

Options

• Aa custom RBAC role for RG2
• Bthe Network Contributor role for RG2
• Cthe Contributor role for the subscription
• Da custom RBAC role for the subscription
• Ethe Network Contributor role for RG1
• Fthe Virtual Machine Contributor role for RG1

• A
  68% (15)
• C
  9% (2)
• D
  5% (1)
• E
  18% (4)

Explanation

Explanation

Assigning the Virtual Machine Contributor role for RG1 (F) grants ServerAdmins exactly the permissions needed to create and manage VMs within RG1, satisfying the first requirement with least privilege. For the second requirement - connecting VMs to existing virtual networks in RG2 - a custom RBAC role for RG2 (A) is necessary because the standard Network Contributor role grants far more permissions than needed (including creating/deleting networks), whereas a custom role can be scoped to only allow joining/reading existing virtual networks.

Why the distractors are wrong:

• B (Network Contributor for RG2): Grants excessive permissions over RG2's network resources (create, delete, modify), violating least privilege.
• C (Contributor for subscription): Far too broad - grants full access across the entire subscription.
• D (Custom role for subscription): Subscription-level scope is wider than necessary; roles should be scoped to the specific resource group.
• E (Network Contributor for RG1): ServerAdmins don't need network permissions in RG1, only VM creation rights there.

Memory Tip

Think "right role, right scope" - always match the minimum permission to the smallest scope. When a built-in role does too much, reach for a custom role. When a built-in role does exactly what's needed at the right scope, use it as-is (like VM Contributor on RG1).

No community discussion yet for this question.