SC-100 Certification Practice Question #272

Question

You need to recommend a solution to meet the security requirements for the InfraSec group.
What should you use to delegate the access?

Accepted Answer

The question asks what to use to *delegate* access to the InfraSec group for managing a specific set of network resources (NSG, Azure Firewall, Front Door, etc.). A subscription, resource group, and management group are merely scopes where a role assignment lands — they don't define which actions are permitted. A built-in role such as Network Contributor would be over-permissive (it can add/remove subnets and NICs beyond InfraSec's duties), violating least privilege. MS Learn's RBAC best practice is to use built-in roles where they fit but create a custom role when you need to grant only the precise permissions required. Both the Suggested Answer and the strongest community votes (24, with a 22-👍 top comment) converge on B, and the lone dissent for "subscription" was withdrawn by its author. Confidence 90.

More SC-100 practice questions