nerdexam
Microsoft

AZ-900 · Question #248

A new policy has been implemented in your organization that limits access to resource group and resource scopes in a detailed, granular way. Various groups and users will be provided access. What woul

The correct answer is B. Role-based access control (RBAC). To implement a new policy that limits access to resource groups and resources in a detailed, granular way for various users and groups, Azure Role-Based Access Control (RBAC) is the appropriate service.

Submitted by deeparc· Mar 5, 2026Describe Azure Management and Governance

Question

A new policy has been implemented in your organization that limits access to resource group and resource scopes in a detailed, granular way. Various groups and users will be provided access. What would you choose to use if you want to implement the new policy?

Options

  • AAzure Advisor
  • BRole-based access control (RBAC)
  • CAzure Policies
  • DLocks

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    92% (24)
  • C
    4% (1)

Why each option

To implement a new policy that limits access to resource groups and resources in a detailed, granular way for various users and groups, Azure Role-Based Access Control (RBAC) is the appropriate service.

AAzure Advisor

Azure Advisor provides recommendations for optimizing cost, security, reliability, operational excellence, and performance, but it does not control access.

BRole-based access control (RBAC)Correct

Azure RBAC allows for granular management of access to Azure resources, enabling you to define specific permissions (roles) at different scopes (management group, subscription, resource group, or resource) and assign them to users, groups, or service principals. This directly addresses the need for detailed and granular access control for various groups and users.

CAzure Policies

Azure Policies enforce rules and effects over your resources to ensure compliance with organizational standards, but they do not define who can access what in a granular way; rather, they define what can be done to resources.

DLocks

Locks prevent resources from being accidentally deleted or modified, but they do not provide granular access control for users and groups.

Concept tested: Azure Role-Based Access Control (RBAC) for granular resource access

Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

Community Discussion

No community discussion yet for this question.

Full AZ-900 Practice