A platform team runs an internal automation tool that must restart VMs and read network interface settings in one resource group. Built-in roles available to the team are broader than the access they want to grant. What should the administrator create?

The Contributor role assigned at the subscription scope.

This would allow far more changes than the automation tool requires and would span the entire subscription.

The Reader role assigned at the resource group scope.

Reader can view settings but cannot restart virtual machines or perform operational changes.

The Network Contributor role assigned at the resource group scope.

This would focus on network resources and still would not provide the needed VM operational permissions.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A custom role with only the required compute and read permissions, assigned at the resource group scope. — A custom role is appropriate when built-in roles do not match the exact operational requirement. By defining only the necessary compute and read actions, the administrator can allow the automation tool to restart VMs and inspect related settings without granting broad write access to unrelated resources. Assigning that role at the resource-group scope keeps the permission boundary aligned to the team’s workload and preserves least privilege. Why others are wrong: Option B is too permissive because Contributor can modify many resource types across the subscription. Option C is read-only and cannot perform restart operations. Option D is the wrong resource family; network permissions alone do not cover VM lifecycle actions or the intended read access.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.