A finance analyst needs read-only access to one storage account named stprod01. The analyst must not see other resources in the subscription. Where should you assign the Reader role?

At the management group scope that contains the subscription

This would grant access to every subscription under that management group, which is far broader than required.

At the subscription scope that contains the storage account

Subscription scope would let the analyst see all resources in the subscription, not just one storage account.

At the resource group that contains the storage account

Resource group scope is narrower than the subscription, but it still exposes every resource in that group.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: At the storage account resource scope — Use the storage account as the RBAC scope when access must be limited to one resource. Azure role assignments inherit downward, so anything assigned at the resource level applies only to that storage account and not to other resources in the resource group or subscription. This is the best least-privilege choice because it gives the analyst exactly the read access needed and nothing broader. Why others are wrong: Management group and subscription scopes are too broad because they expose many unrelated resources. Resource group scope is still wider than requested if the group contains more than the storage account. The key concept is choosing the narrowest scope that satisfies the business need.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.