A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?

At the management group that contains the subscription.

That scope would grant access across multiple subscriptions and resource groups, which is broader than the team requires for a single application.

At the subscription scope.

Subscription scope would include every resource group in the subscription, so the team would gain more access than requested.

At each individual resource in the resource group.

Individual resource assignments would work, but they are harder to maintain and easier to miss when new resources are added to the application.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: At the rg-finance-app resource group scope. — The resource group is the right scope because it matches the administrative boundary of the application. Assigning Contributor there ensures the team can manage every current resource in rg-finance-app and any future resources added to that group, while still preventing access to other groups in the subscription. AZ-104 emphasizes choosing the narrowest scope that satisfies the business requirement. Why others are wrong: Management group and subscription scopes are too broad because they cover many more resources than the finance app. Assigning at each individual resource is overly granular and creates unnecessary maintenance when the workload changes. The resource group scope provides inherited access with the right balance of control and simplicity.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.