A support team must be able to start, stop, and restart virtual machines in one application resource group, but they must not create or delete VMs, modify disks, or manage networking. What is the best access approach?

Assign Contributor at the subscription scope so the team can manage all resources.

Contributor grants broad management rights across the scope, which is more access than the requirement allows. It would let the team modify many resource types beyond virtual machines. This violates least privilege and increases the chance of unintended changes.

Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.

Reader provides view-only access and cannot perform operational actions on VMs. Azure Policy does not grant permissions to users; it enforces compliance for resources. This combination cannot satisfy the requirement to restart or stop virtual machines.

Apply a resource lock to the resource group so the team can only make approved changes.

Locks are a change-prevention control, not a permission model for selective operational access. A lock would block some operations, but it would not selectively grant start, stop, or restart permissions. It also would not replace RBAC for least-privilege access.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope. — When no built-in role is narrow enough, a custom RBAC role is the right solution. The administrator can define only the VM power actions required and assign that role at the resource group scope so the support team can operate the application VMs without creating, deleting, or altering unrelated resources. This is the cleanest least-privilege design. Why others are wrong: Contributor is too broad, because it allows many resource changes beyond VM power operations. Reader provides no operational capability at all, and Azure Policy cannot be used to grant user permissions. Resource locks only prevent changes; they do not act as a selective access grant. A custom role is the only option that precisely matches the need.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.