AZ-104 Certification Practice Question #40

Question

You have an Azure subscription named Subscription1 that contains a resource group named RG1.
In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

There is a classic discrepancy between the official Microsoft answer key and actual lab execution. Officially, to follow the principle of least privilege, the exam expects **Network Contributor on LB1** to manage LB1 (adding backend pool) and **Network Contributor on LB2** to manage LB2 (adding a health probe), because Network Contributor is the built-in role for network management and scope is limited to the specific resource. However, in practice (as validated by extensive community lab testing), adding VMs to a backend pool requires writing permissions to the VM's network interfaces (NICs), which are separate resources inside **RG1**. Therefore, performing these operations in the Azure Portal actually fails unless permissions are granted at the resource group level (**Network Contributor on RG1**). Because of this split, we present both the exam-expected answers and the lab-correct answers.

More AZ-104 practice questions