A support engineer must start and restart one specific virtual machine from the Azure portal, but must not be able to delete the VM, change networking, or grant access to others. Which two actions should be included in a custom role? Select two.

Microsoft.Compute/virtualMachines/delete gives the ability to remove the VM from the subscription.

Delete is far too permissive for a support-only role. It would allow destruction of the virtual machine, which is explicitly not required and would create unnecessary risk. This option is the opposite of least privilege for routine operations.

Microsoft.Network/networkInterfaces/write is needed because a VM start or restart always requires NIC modification rights.

Starting or restarting a VM does not require permission to change the network interface. Granting NIC write access would broaden the role into network administration, which the requirement explicitly excludes. That would be excessive and unrelated to the task.

Microsoft.Authorization/roleAssignments/write would let the engineer grant access to other users and manage permissions.

Role assignment write permissions are administrative access-control rights, not VM operations. Including them would let the engineer modify authorization for many resources, which is not needed and would violate the requirement to avoid granting access-management capabilities.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft.Compute/virtualMachines/start/action grants the ability to start the VM without broader management permissions. — A least-privilege custom role should include only the exact VM operations needed. The start and restart actions are separate Azure RBAC actions, and together they allow the engineer to perform the requested operational work without giving delete, network, or authorization permissions. This is the right pattern when built-in roles are too broad for a narrow support task. Why others are wrong: Delete, network write, and role assignment write all grant much broader capabilities than the scenario requires. They would expose destructive, networking, or authorization operations that have nothing to do with simply starting and restarting one VM.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.