A support engineer needs to restart only one virtual machine named VM-App01. The engineer must not gain access to any other VM, storage account, or network resource in the resource group. At which scope should you assign the required RBAC role?

At the management group scope that contains the subscription

This would grant access far more broadly than needed and would affect multiple subscriptions.

At the resource group scope that contains the virtual machine

This would apply to every resource in the group, which is broader than the stated requirement.

At the subscription scope that contains the resource group

This would allow access across the subscription and is not appropriate for a single VM task.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: At the specific virtual machine resource scope — RBAC should be assigned at the narrowest scope that satisfies the operational need. Because the engineer must manage only one virtual machine and nothing else, the correct place to assign the role is the virtual machine resource itself. That keeps the permission isolated to VM-App01 and avoids unintentionally granting rights over the rest of the resource group or subscription. Why others are wrong: Management group, resource group, and subscription scopes are all broader than necessary. They would create unnecessary access to other resources, increasing risk and making access removal harder later.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.