A contractor must manage only VM1 and VM2 in rg-prod. The contractor must not be able to manage any other resource in the resource group. Which two role assignment scopes should you create? Select two.

Assign the role at the rg-prod resource group scope.

Resource group scope would apply to every resource in rg-prod, which is broader than the requirement. It would not limit access to only VM1 and VM2.

Assign the role at the subscription scope.

Subscription scope would grant visibility and potential control across many unrelated resource groups. That is the opposite of the requested narrow scope.

Assign the role at the management group scope.

Management group scope is even broader than subscription scope and would cascade to many subscriptions. It would greatly exceed the contractor's required access.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign the role at the VM1 resource scope. — To limit access to only two virtual machines, you must assign the role directly at each VM resource scope. RBAC inheritance works downward, so broader scopes such as the resource group, subscription, or management group would grant access to more resources than intended. Separate resource-level assignments provide the exact least-privilege boundary required. Why others are wrong: Any broader scope would include other resources and violate the requirement to restrict the contractor to VM1 and VM2 only. RBAC inheritance is useful when you want broader reach, but in this case it would create unnecessary access to unrelated resources in rg-prod or beyond.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.