AZ-104 Certification Practice Question #275

Question

You have the following custom role-based access control (RBAC) role.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

- **Statement 1:** Role assignment creation requires write permissions on Microsoft.Authorization resources (specifically `Microsoft.Authorization/roleAssignments/write`). Since the custom role does not grant this in `Actions` and explicitly denies authorization write actions in `NotActions` (`Microsoft.Authorization/*/Write`), users assigned to Role1 cannot assign roles to other users. Thus, the statement is **No**.
- **Statement 2:** The custom role includes `Microsoft.Compute/virtualMachines/*` (allowing VM creation) and `Microsoft.Resources/deployments/*` (allowing ARM deployments), along with read access to resource groups (`Microsoft.Resources/subscriptions/resourceGroups/read`). In Azure, creating resources in a resource group does not require write access on the resource group itself; read access to the resource group is sufficient as long as you have write permissions on the resource type. Thus, the statement is **Yes**.
- **Statement 3:** Setting a static IP address on a VM is done by modifying the IP configuration of its network interface. The role grants `Microsoft.Network/networkInterfaces/*`, which includes write permission on network interfaces, enabling this action. Thus, the statement is **Yes**.

More AZ-104 practice questions