SC-300 Certification Practice Question #40

Question

You have the Azure resources shown in the following table.

To which identities can you assign the Contributor role for RG1?

Accepted Answer

The question asks about the **Azure RBAC** Contributor role at a resource-group scope. Per MS Learn, any security principal — user, group, service principal, or managed identity — can receive an Azure role, and there is no Azure RBAC restriction barring dynamic-membership groups. The popular D camp conflates this with the **role-assignable group** requirement, which only applies when a group is assigned a *Microsoft Entra directory role* (that group must have membershipType = Assigned, not Dynamic). Contributor is not an Entra role, so Group1's dynamic membership is irrelevant and all four identities qualify. Multiple lab-tested community confirmations (JohnnyChimpo, Oskarma, j11v0sud) plus the Suggested Answer and the 37-vote majority align on E. Confidence is held to 86% rather than higher because the highest single 👍 count (20) sits with the incorrect D answer, so there is meaningful, if mistaken, dissent.

More SC-300 practice questions