A security team wants operators in one resource group to start, stop, and restart virtual machines, but they must not create VMs, delete VMs, or manage disks and networking. What should the administrator configure?

Assign the Contributor role at the resource group scope.

Contributor is too broad because it allows users to create and modify many resource types in the scope.

Assign the Virtual Machine Contributor role at the resource group scope.

Virtual Machine Contributor still grants more VM-related permissions than the requirement allows, including broader management actions.

Use Azure Policy to deny creation of new VMs in the resource group.

Azure Policy can enforce compliance, but it does not grant operational permissions to start or stop existing VMs.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom RBAC role with only the VM power actions and assign it at the resource group scope. — This requirement is about authorization, not compliance enforcement. Azure RBAC controls what operators are allowed to do, and a custom role lets you include only the VM power-related actions needed for day-to-day operations. Scoping that custom role to the resource group keeps access limited to the intended workload while avoiding broader capabilities that built-in roles often include. Why others are wrong: Contributor is far too permissive and would let operators manage many unrelated resources. Virtual Machine Contributor is closer, but it still grants actions beyond simple power control. Azure Policy is the wrong tool because it can block or audit configurations, but it does not grant the permissions needed to operate the VMs.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.