AZ-104 Certification Practice Question #144

Question

You have an Azure subscription.

You plan to create a role definition to meet the following requirements:

•	Users must be able to view the configuration data of a storage account.
•	Users must be able to perform all actions on a virtual network.
•	The solution must use the principle of least privilege.

What should you include in the role definition for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

To satisfy the first requirement using the principle of least privilege, users only need to view (read) the configuration data of a storage account. The specific action that permits this without allowing any modifications is `Microsoft.Storage/storageAccounts/read`. For the second requirement, users must be able to perform "all actions" on a virtual network. To cover every possible operation (including read, write, delete, and join subnet actions), a wildcard is necessary. The correct action representing all actions on virtual networks is `Microsoft.Network/virtualNetworks/*`.

More AZ-104 practice questions