AZ-104 Implement and Manage Storage Practice Question
A finance operations team manages virtual machines in RG-App. They must start, stop, deallocate, and view VM properties for any VM in that resource group. They must not be able to delete VMs, read NIC settings, or manage disks. What should the administrator do?
⚠ Common exam trap
Many candidates assume the built-in Virtual Machine Contributor role is sufficient because it covers VM management, but they overlook that it includes delete and other broader permissions that must be explicitly excluded via a custom role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with only the required VM actions and assign it at the RG-App scope.
The required permissions (start, stop, deallocate, view properties) are a subset of the built-in Virtual Machine Contributor role, but that role also includes delete and other management actions. A custom role allows you to grant only the specific Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read permissions, while explicitly excluding delete, NIC read, and disk management actions. Assigning this custom role at the RG-App scope ensures the team can manage VMs without broader access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the built-in Virtual Machine Contributor role at the subscription scope.
Why it's wrong here
Assigning the built-in Virtual Machine Contributor role at the subscription scope is incorrect because the scope is far too broad; it grants the team the ability to manage all virtual machines in every resource group within the entire Azure subscription, not just those in RG-App. While Virtual Machine Contributor does limit actions to VM operations, this approach violates the principle of least privilege by exposing resources outside the team's responsibility and increasing the potential blast radius of any accidental or malicious change.
When this WOULD be correct
If the requirement was to manage all VMs across multiple resource groups in the subscription (e.g., start, stop, deallocate, view properties) without restricting deletion or disk management, and the scope needed to be subscription-wide.
- ✓
Create a custom role with only the required VM actions and assign it at the RG-App scope.
Why this is correct
Creating a custom role that includes only the specific VM actions the finance operations team needs (such as Microsoft.Compute/virtualMachines/start/action, /restart/action, and /deallocate/action) and assigning that role at the RG-App resource group scope is the correct implementation of least privilege. This confines every permission to the exact resource group and to the precise VM operations required, preventing the team from modifying other resource groups or unrelated resource types while still allowing them to perform their daily start/stop/deallocate tasks.
- ✗
Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.
Why it's wrong here
Assigning the built-in Reader role at the RG-App scope and instructing the team to use portal 'Start' and 'Stop' buttons is ineffective because the Reader role only permits viewing the VM's status and configuration; it does not include any write or action permissions like Microsoft.Compute/virtualMachines/start/action. When the team clicks the portal start or stop buttons, Azure RBAC will deny the operation with an authorization error, so this approach provides no usable VM management capability and is therefore not a valid solution.
When this WOULD be correct
This option would be correct if the question required read-only access to all resources in the resource group, with no need to perform any management actions like start/stop/deallocate.
- ✗
Assign the built-in Contributor role at the resource group scope.
Why it's wrong here
Assigning the built-in Contributor role at the resource group scope is wrong because Contributor grants full management rights over all resource types within that resource group, including virtual networks, network interfaces, disks, and storage accounts. The finance operations team would gain the ability to delete or modify NICs, change disk configurations, and alter network security settings—operations far beyond the start, stop, and deallocate actions they actually require—so this is an over-permissive and unsafe choice.
When this WOULD be correct
In a scenario where the team needs full management capabilities (including deletion, NIC reading, and disk management) for all resources in the resource group, assigning the Contributor role at the resource group scope would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom role with only the required VM actions and assign it at the RG-App scope.Correct answer▾
Why this is correct
Creating a custom role that includes only the specific VM actions the finance operations team needs (such as Microsoft.Compute/virtualMachines/start/action, /restart/action, and /deallocate/action) and assigning that role at the RG-App resource group scope is the correct implementation of least privilege. This confines every permission to the exact resource group and to the precise VM operations required, preventing the team from modifying other resource groups or unrelated resource types while still allowing them to perform their daily start/stop/deallocate tasks.
✗Assign the built-in Virtual Machine Contributor role at the subscription scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning Virtual Machine Contributor at subscription scope grants permissions to all VMs in the subscription, not just RG-App, and includes actions like delete VM and manage disks, exceeding the required permissions.
★ When this WOULD be the correct answer
If the requirement was to manage all VMs across multiple resource groups in the subscription (e.g., start, stop, deallocate, view properties) without restricting deletion or disk management, and the scope needed to be subscription-wide.
Why candidates choose this
Candidates may think Virtual Machine Contributor is the closest built-in role for VM management, overlooking that it includes unwanted permissions and that scope can be narrowed to a resource group.
✗Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.Wrong answer — click to see why▾
Why this is wrong here
The built-in Reader role only allows viewing resources, not starting, stopping, or deallocating VMs. Portal buttons for these actions require write permissions, so the team would be unable to perform the required operations.
★ When this WOULD be the correct answer
This option would be correct if the question required read-only access to all resources in the resource group, with no need to perform any management actions like start/stop/deallocate.
Why candidates choose this
Candidates may mistakenly believe that the Reader role combined with portal buttons provides sufficient permissions, overlooking that portal actions require underlying RBAC write permissions.
✗Assign the built-in Contributor role at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
The built-in Contributor role includes permissions to delete resources, read NIC settings, and manage disks, which violates the requirement to restrict these actions.
★ When this WOULD be the correct answer
In a scenario where the team needs full management capabilities (including deletion, NIC reading, and disk management) for all resources in the resource group, assigning the Contributor role at the resource group scope would be appropriate.
Why candidates choose this
Candidates may assume Contributor provides sufficient VM management permissions without realizing it also grants broader resource management rights that exceed the specified restrictions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.