Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Azure Administrator Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
Copilot answer: "Both solutions are valid, but the preferable one depends on your specific needs and management preferences: Assigning the Network Contributor role at the resource group level (RG1): Pros: Simplifies role management by granting Admin1 permissions to manage all network-related resources within the resource group, including both LB1 and LB2. Cons: Admin1 will have broader access, which might include other network resources in RG1 that they don’t need to manage. Assigning the Network Contributor role directly to LB1 and LB2: Pros: Follows the principle of least privilege more strictly by limiting Admin1’s access to only the specific load balancers they need to manage. Cons: Requires more granular role assignments, which can be more complex to manage if there are many resources. If you want to keep things simple and Admin1 needs to manage multiple network resources within RG1, assigning the role at the resource group level is preferable. However, if you want to strictly limit Admin1’s access to only the load balancers, assigning the role directly to LB1 and LB2 is the better choice."
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
1. network contributor at RG1 At LB1 is not sufficient because adding a VM to a backend pool requires Azure to modify the NIC’s IP configuration, because backend pool membership is stored on the NIC, not on the load balancer. The only exception where assigning network contributor al LB1 would be sufficient is when using IP-based backend pool members (manually entered IP addresses), not VM NICs. In that scenario, Azure does not modify NICs, so LB‑scope permissions are sufficient. But this is uncommon in typical VM-based backend pools. 2.network contributor at LB2
I think what is tripping people up in the first box is whether we are creating or adding an existing backend pool. You need RG1 if you are creating a backend pool but this says adding a backend pool which is a function of the loadbalancer configuration.
Network Contributor to LB1 and LB2. The statement says that the LBs are already created, and Admin 1 needs these right with leatst priviliges. You are not Admin 1...Admin 1 is another user and giving him "Contributor to the RGs" is too broad.