SC-300 Certification Practice Question #26

Question

You have an Azure subscription.

You need to create two custom roles named Role1 and Role2. The solution must meet the following requirements:

•	Users that are assigned Role1 can create or delete instances of Azure Container Apps.
•	Users that are assigned Role2 can enforce adaptive network hardening rules.

Which resource provider permissions are required for each role? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The "What are the resource providers for Azure services" page lists **Microsoft.App** as the namespace for Azure Container Apps, so the role that creates/deletes container app instances needs Microsoft.App (`containerApps/write` and `containerApps/delete`). Adaptive network hardening is a Microsoft Defender for Cloud capability, and the operation `Microsoft.Security/adaptiveNetworkHardenings/.../enforce` lives under the **Microsoft.Security** provider. The two top comments (32 and 11 👍) match, and several comments quote the exact operation strings. The "Compute"/"Network" dissent is a common trap — Compute covers VMs, not Container Apps, and the network-hardening operations are owned by Microsoft.Security, not Microsoft.Network. Confidence 92 reflects strong doc + community agreement with only low-vote dissent.

More SC-300 practice questions