Hotspot Question You have an Azure subscription that contains a user named User1. User1 is assigned the Reader role for the subscription. You plan to create a custom role named Role1 and assign…

Question

Exhibit

Answer Area

• Microsoft Monitoring Insights Microsoft.SecurityGraphNo
• Microsoft Monitoring Insights Enable your workforce to be productive on all their devices, while keeping your organization's information protected.No
• Microsoft Monitoring Insights Microsoft.DynamicsTelemetryNo
• Microsoft Network Connect cloud and on-premises infrastructure and services to provide your customers and users the best.Yes
• Microsoft Operations Management A simplified management solution for any enterpriseNo
• Microsoft Policy Insights Summarize policy states for the subscription level policy definition.No
• Microsoft Portal Build, manage, and monitor all Azure products in a single, unified console.Yes
• Microsoft Power BI Dedicated Manage Power BI Premium dedicated capacities for exclusive use by an organization.No
• Microsoft Power Platform Microsoft.PowerPlatformNo
• Microsoft Project Babylon Microsoft.ProjectBabylonNo
• Microsoft Purview Microsoft.PurviewNo
• Microsoft Resource Graph Powerful tool to query, explore, and analyze your cloud resources at scale.No

Explanation

This question tests knowledge of Azure RBAC custom role permissions required to manage Application Security Groups (ASGs). You must identify the two specific Microsoft.Network permissions needed to both read/list and create/manage ASGs.

Approach. To create and manage Application Security Groups in Azure, User1 needs two permissions added to Role1: (1) Microsoft.Network/applicationSecurityGroups/write – This permission allows the user to create and update (manage) Application Security Groups. Without write permission, the user cannot create new ASGs or modify existing ones. (2) Microsoft.Network/applicationSecurityGroups/read – This permission (or alternatively listed as part of broader read access) allows the user to view and list Application Security Groups in the Azure portal. Without read permission, the user cannot see existing ASGs in the portal UI. Since User1 already has the Reader role at the subscription level (which grants read access broadly), the most critical missing permission is the write permission. However, for the custom role to explicitly grant management capability, both read and write on the applicationSecurityGroups resource type should be included. Some exam versions also list Microsoft.Network/applicationSecurityGroups/delete as needed for full management, but the two core permissions are read and write.

Concept tested. Azure RBAC custom role creation and the specific Microsoft.Network resource provider permissions required to create and manage Application Security Groups (ASGs). Understanding the difference between read (view) and write (create/update) permissions at the resource type level within Azure's RBAC model.

Reference. https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftnetwork - specifically the applicationSecurityGroups operations: Microsoft.Network/applicationSecurityGroups/read and Microsoft.Network/applicationSecurityGroups/write

No community discussion yet for this question.