A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?

The entire subscription that contains vm-app01.

That scope would grant access to every resource in the subscription, which is broader than required.

The resource group that contains vm-app01.

This would allow management of every VM in the resource group, not just one machine.

The management group that contains the subscription.

This is the broadest option and would affect many subscriptions and resources.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: The vm-app01 virtual machine resource itself. — Azure RBAC permissions flow downward from management group to subscription, resource group, and individual resource. When a user only needs to manage one VM, the correct approach is to assign the role directly on that VM. That gives the engineer the needed operational rights without exposing other VMs, other resource groups, or the whole subscription. Choosing the smallest workable scope is a core least-privilege practice. Why others are wrong: Subscription and management group scopes are far too broad for a single VM requirement. Resource group scope is still wider than necessary because it would include every resource in that group. Only the individual VM resource limits access to the exact machine the engineer must manage.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.