nerdexam
Microsoft

AZ-500 · Question #286

You have an Azure subscription named Subscription1 that contains a resource group named RG1 and the users shown in the following table. You perform the following tasks: - Assign User1 the Network…

The correct answer is A. The Compliance State of both policy assignments is Non-compliant. Both policy assignments are non-compliant because User1 and User2, implicitly treated as external accounts, possess write permissions through their assigned roles, violating the policy definition.

Submitted by jian89· Mar 6, 2026Secure identity and access

Question

You have an Azure subscription named Subscription1 that contains a resource group named RG1 and the users shown in the following table. You perform the following tasks: - Assign User1 the Network Contributor role for Subscription1. - Assign User2 the Contributor role for RG1. To Subscription1 and RG1, you assign the following policy definition: External accounts with write permissions should be removed from your subscription. What is the Compliance State of the policy assignments?

Options

  • AThe Compliance State of both policy assignments is Non-compliant.
  • BThe Compliance State of the policy assignment to Subscription1 is Compliant, and the
  • CThe Compliance State of the policy assignment to Subscription1 is Non-compliant, and the
  • DThe Compliance State of both policy assignments is Compliant.

How the community answered

(26 responses)
  • A
    58% (15)
  • B
    27% (7)
  • C
    4% (1)
  • D
    12% (3)

Why each option

Both policy assignments are non-compliant because User1 and User2, implicitly treated as external accounts, possess write permissions through their assigned roles, violating the policy definition.

AThe Compliance State of both policy assignments is Non-compliant.Correct

User1 has the Network Contributor role on Subscription1, which grants write permissions, and is considered an "external account" by the policy. Similarly, User2 has the Contributor role on RG1, granting extensive write permissions, and is also treated as an "external account" by the policy, leading to non-compliance for both assignments.

BThe Compliance State of the policy assignment to Subscription1 is Compliant, and the

This choice is incorrect because the policy identifies both User1 and User2 as external accounts with write permissions, making both assignments non-compliant, not just one.

CThe Compliance State of the policy assignment to Subscription1 is Non-compliant, and the
DThe Compliance State of both policy assignments is Compliant.

Concept tested: Azure Policy compliance evaluation with RBAC

Source: https://learn.microsoft.com/en-us/azure/azure-policy/overview

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice