az-104 Practice Question 1695
Exam: az-104
Domain: Manage Azure identities and governance
Topic: Manage access by using RBAC
Difficulty: medium
Contoso Ltd has recently migrated its on-premises infrastructure to Azure. They want to ensure that only the necessary users have access to specific resources within their subscription. You need to create a custom role with least privilege to manage virtual machines in a specific resource group. Which of the following actions should you take to achieve this goal?
Answer Options
A
Assign the 'Virtual Machine Contributor' role to the user.
B
Create a custom role with specific permissions for managing virtual machines in the specified resource group.
C
Use the 'Contributor' role and assign it to the user.
D
Assign the 'Owner' role to the user.
Correct Answer
B: Create a custom role with specific permissions for managing virtual machines in the specified resource group.
Explanation
The correct answer is B. Creating a custom role with least privilege ensures that users have only the necessary permissions to perform their job functions without unnecessary access. This aligns with the principle of least privilege, which minimizes potential damage from unauthorized access. Option A is incorrect because built-in roles may not provide the exact level of control needed. Option C is incorrect as it does not address the creation of a custom role. Option D is incorrect because assigning an existing role without customization does not meet the requirement of least privilege.