AZ-104 Question 74

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  You want User1 to: Deploy virtual machines Manage virtual networks But only give the minimum required permissions (least privilege) ✅ Contributor Role Allows creating and managing all types of Azure resources, including virtual machines and virtual networks Does NOT allow managing access (i.e., assigning roles) Fits the principle of least privilege for the tasks mentioned ❌ Why the other options are incorrect: A. Owner Too much access – includes full permissions plus the ability to manage RBAC (assign roles), which violates least privilege B. Virtual Machine Contributor Only allows management of virtual machines Does not grant permissions for virtual networks, so this doesn’t meet the requirement D. Virtual Machine Administrator Login Only allows login to virtual machines with administrative privileges Does not allow deploying or managing VMs or networks

• Chose B1

  Virtual Machine Contributor (Option B): Permissions: Create and manage virtual machines. Manage virtual networks (e.g., create, update, delete virtual networks and subnets). Manage network interfaces and disks. Limitations: Does not allow User1 to manage other Azure resources (e.g., storage accounts, databases).

• Chose C1

  Virtual Machine Contributor: This role only allows the user to manage VMs but not virtual networks, so it would not provide the ability to manage virtual networks.