AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The VM in RG-Apps has a direct Contributor assignment that does not apply elsewhere.

  Why it's wrong here

  The scenario specifically says the Contributor role was assigned at the RG-Apps resource group scope, not directly on the VM. A direct assignment would be listed on the VM's Access control (IAM) blade as a direct role assignment, while an inherited assignment appears as inherited or effective. Because the assignment is at the resource group level, the VM inherits it; it is not a separate direct assignment.

  When this WOULD be correct

  If a user is directly assigned the Contributor role on a specific VM resource (not at the resource group scope), and no other roles apply, then that direct assignment would grant write access only to that VM and not to others in the same resource group.

• ✓

  The VM in RG-Apps inherited Contributor from the resource group, while RG-Shared only inherits Reader.

  Why this is correct

  RBAC permissions are inherited from higher scopes to lower scopes. When Contributor is assigned to the RG-Apps resource group, all resources within, including the VM, inherit that role at that scope. RG-Shared, being outside that scope, only gets the subscription-level Reader assignment, so its resources don't receive Contributor. This additive inheritance explains why the VM has Contributor effective access.

• ✗

  Reader always overrides Contributor when both roles exist in the same subscription.

  Why it's wrong here

  RBAC authorization is cumulative, not override-based. If the same principal holds both Reader and Contributor at overlapping scopes, the effective permissions are the union of both roles, so the Reader role does not negate any of Contributor's write actions. Only an explicit Deny assignment can block permissions, and a lower-privileged role like Reader cannot override a higher-privileged one.

  When this WOULD be correct

  This option would be correct if the question described a scenario where a user has both a deny assignment and a role assignment, and the deny assignment explicitly overrides the role. For example, if a custom role with 'NotActions' or a deny assignment is applied at a higher scope that blocks write access even if Contributor is assigned at a lower scope.

• ✗

  Azure Policy is granting write access only inside RG-Apps because the subscription has no policy.

  Why it's wrong here

  Azure Policy is a compliance and governance service that evaluates resources against rules, using deny, audit, or deploy effects. It does not grant RBAC permissions; write access comes solely from role assignments like Contributor. Even without a subscription policy, Policy cannot create access rights—it can only block or modify configuration for non-compliance, not assign Contributor.

  When this WOULD be correct

  A question where a VM in RG-Apps can be modified but a VM in RG-Shared cannot, and the subscription has a policy that denies write access to all resources except those in RG-Apps. The policy would be the reason for the difference.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question