Hotspot Question You have an Azure subscription. You have the following custom role-based access control (RBAC) role definition. For each of the following statements, select Yes if the statement is…

Question

Exhibit

Answer Area

• The custom role grants a user permission to delete Azure SQL Database resources.
• The custom role grants a user permission to manage the Microsoft Entra admin settings for an Azure SQL Database server.
• The custom role grants a user permission to reset the administrator password for instances of Azure Database for MariaDB.

Explanation

This question tests understanding of Azure RBAC custom role definitions, specifically how Actions, NotActions, AssignableScopes, and DataActions interact to determine what a principal can or cannot do within a subscription.

Approach. To evaluate each statement, you must analyze the custom role's Actions (permitted control-plane operations), NotActions (excluded operations from Actions), DataActions (permitted data-plane operations), and AssignableScopes (where the role can be assigned). A principal with this role CAN perform actions listed in Actions minus any listed in NotActions. If a statement claims the role allows restarting VMs, check if 'Microsoft.Compute/virtualMachines/restart/action' or a wildcard like 'Microsoft.Compute/virtualMachines/*' is in Actions and not excluded by NotActions. For reading resource groups, check for 'Microsoft.Resources/subscriptions/resourceGroups/read'. DataActions apply only to data-plane operations (e.g., reading blob data), not control-plane. AssignableScopes defines where the role can be assigned, not what the role can do - a role scoped to a subscription can be assigned at that subscription or any child resource group/resource.

Concept tested. Azure RBAC custom role definition evaluation: understanding how Actions, NotActions, DataActions, NotDataActions, and AssignableScopes combine to determine effective permissions for a custom role, and the distinction between control-plane and data-plane operations.

Reference. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions

No community discussion yet for this question.