An administrator assigns Contributor at the RG-Apps resource group scope and Reader at the subscription scope. A developer opens a VM inside RG-Apps and can change its settings, but a different VM in RG-Shared is read-only. Which statement best explains this behavior?

The VM in RG-Apps has a direct Contributor assignment that does not apply elsewhere.

The scenario describes a resource-group assignment, not a separate direct assignment on the VM.

Reader always overrides Contributor when both roles exist in the same subscription.

RBAC permissions are cumulative, not overridden by a lower role such as Reader.

Azure Policy is granting write access only inside RG-Apps because the subscription has no policy.

Azure Policy does not grant permissions. It evaluates compliance and can deny or deploy settings, but not RBAC access.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: The VM in RG-Apps inherited Contributor from the resource group, while RG-Shared only inherits Reader. — The developer can modify resources in RG-Apps because the Contributor role was assigned at the resource group scope and is inherited by all resources in that group. The Reader role at the subscription scope is also inherited, but it does not remove the higher Contributor permission. Resources in RG-Shared do not receive the Contributor assignment, so they remain read-only under the inherited Reader access. Why others are wrong: RBAC does not use a simple override model where Reader cancels Contributor. Azure Policy also cannot grant write permissions. The key idea is inheritance from the resource group to its child resources, plus cumulative permissions.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.