AZ-104 Question 30
Single answerA user named Alex has been assigned the Reader role at the subscription level. However, Alex is also a member of a security group that has the Contributor role assigned on a specific resource group. Which statement accurately describes Alex’s effective permissions on that resource group?
- A
Alex can only read resources in that resource group due to the subscription-level role.
- B
Alex can create and manage resources in that resource group because of the group’s Contributor role.
- C
Alex’s permissions are removed at the resource group level by the subscription-level assignment.
- D
Alex can manage resources but cannot view them in the portal due to overlapping role assignments.
Show answer and explanation
Correct answer: B
Explanation
In Azure RBAC, effective permissions are the combination of all role assignments. Since Alex is part of a security group that holds the Contributor role at the resource group scope, that role grants Alex the ability to create and manage resources there, even though he has Reader permissions at the subscription level.
- A. Incorrect.
Having the Reader role at the subscription level does not reduce permissions assigned at a more specific scope; permissions are additive, not overridden.
- B. Correct.
Being part of a group that has the Contributor role at the resource group level grants Alex the ability to create, modify, and delete resources within that resource group.
- C. Incorrect.
Subscription-level Reader permissions do not negate any other roles. Role-based access is additive, so nothing is removed at the resource group level.
- D. Incorrect.
Having Contributor permissions includes the ability to both view and manage resources, so there is no scenario where Alex can manage but not view the resources.