A team needs Reader access to exactly two Azure resources that are in the same resource group, and they must not gain access to other resources in that group. Which two scope choices are appropriate? Select two.

Assign the role at the resource group scope.

Resource group scope would grant access to every resource inside the group, not just the two named resources. That is broader than the requirement and violates least privilege.

Assign the role at the subscription scope.

Subscription scope would extend permissions to all resource groups in the subscription. That is much broader than needed for only two specific resources.

Assign the role at the management group scope.

Management group scope would inherit to every subscription beneath it. That is appropriate for broad governance, but not for limiting access to two individual resources.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign the role at the storage account scope. — When the requirement is access to only two specific resources, the correct plan is to assign RBAC at each resource scope. That is narrower than resource group or subscription scope, so it does not expose other resources in the same group. This question tests scope planning and the principle of choosing the smallest scope that still satisfies the task. Why others are wrong: Resource group, subscription, and management group scopes all grant access far beyond the two named resources. They may be convenient, but they would break least-privilege design. The right answer is to scope the role exactly where the resources live, not where it is merely easier to administer.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.