A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Assign the role at the rg-prod resource group scope.

Resource group scope would grant access to every resource inside rg-prod, which is broader than required.

Assign the role at the subscription scope.

Subscription scope would expose far more resources than the contractor should manage.

Assign the role at the management group scope.

Management-group scope is the broadest option here and would inherit into many subscriptions.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Assign the role at the VM1 resource scope. — Azure RBAC inherits permissions downward from the assigned scope, so the smallest scopes that satisfy this requirement are the individual VM resource scopes. Assigning Contributor directly on VM1 and VM2 gives the contractor control only over those two virtual machines. It prevents access to the other resources in rg-prod and avoids unintended inheritance from resource group, subscription, or management group levels. Why others are wrong: Resource group, subscription, and management group scopes all grant broader inherited permissions than the scenario allows. They would let the contractor affect other resources, which violates the requirement. The point of this design is to use the narrowest possible RBAC scope so only the two specified VMs are manageable.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.