SC-300 Certification Practice Question #57

Question

You have an Azure subscription that contains a user named User1 and two resource groups named RG1 and RG2.

You need to ensure that User1 can perform the following tasks:

•	View all resources.
•	Restart virtual machines.
•	Create virtual machines in RG1 only.
•	Create storage accounts in RG1 only.

What is the minimum number of role-based access control (RBAC) role assignments required?

Accepted Answer

Using Azure **built-in** roles, three assignments satisfy all four requirements: Reader at the subscription scope (view all resources), Virtual Machine Contributor (creates/manages VMs and restarts them) and Storage Account Contributor (creates storage accounts) both scoped to RG1 — and because RG1-scoped creation rights don't extend to RG2, the "RG1 only" constraints hold. VM restart is satisfied because Virtual Machine Contributor includes the restart action; if restart is required in RG2 as well it could be scoped to the subscription, still 3 assignments. The 10-👍 Highly Voted dissent argues 2 assignments using *custom* roles, which is technically achievable but assumes the question permits custom role definitions; the exam's recorded answer and the 32-vote majority treat this as a built-in-role minimization problem and land on 3. Because the Suggested Answer and Most Voted both say C while a well-reasoned high-vote minority makes a legitimate case for B under a custom-role reading, confidence is held at 80 to reflect the genuine built-in-vs-custom split — C wins as the documented/most-voted answer.

More SC-300 practice questions