nerdexam
Microsoft

AZ-500 · Question #363

Hotspot Question You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create a custom RBAC role in Subscription1 by using the following…

The correct answer is User1 can add VM1 to VNET1. = No; User1 can start and stop App1. = Yes; User1 can start and stop cont1. = No. Role1 is assigned to User1 on RG1 only, and based on the JSON definition, the role includes Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/restart/action (or stop) permissions, which apply to virtual machines - allowing User1 to start and…

Submitted by kim_seoul· Mar 6, 2026Manage Azure identities and governance - specifically implementing and managing role-based access control (RBAC) with custom roles and understanding permission scopes

Question

Hotspot Question You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create a custom RBAC role in Subscription1 by using the following JSON file. You assign Role1 to User1 on RG1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #363 exhibit 1
AZ-500 question #363 exhibit 2

Answer Area

  • User1 can add VM1 to VNET1.No
  • User1 can start and stop App1.Yes
  • User1 can start and stop cont1.No

Explanation

Role1 is assigned to User1 on RG1 only, and based on the JSON definition, the role includes Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/restart/action (or stop) permissions, which apply to virtual machines - allowing User1 to start and stop App1 (a Virtual Machine in RG1). Adding VM1 to VNET1 requires Microsoft.Network/virtualNetworks/join/action or write permissions on the network, which are not included in Role1's allowed actions. Cont1 is a container instance (Microsoft.ContainerInstance), and Role1 only grants permissions scoped to Microsoft.Compute resources, so container operations are not permitted.

Topics

#RBAC#Custom Roles#Azure Identity and Access Management#Resource Permissions

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice