An application team needs Contributor access only for the resources in rg-app. They must not manage any other resources in the subscription. At what scope should you assign the role?

Management group scope

This scope is broader than needed and would affect multiple subscriptions or child groups.

Subscription scope

This would allow the team to manage every resource in the subscription, which is too broad.

Resource scope

This is narrower than required and would need separate assignments for each resource.

What does this AZ-104 question test?

OSPF neighbours must agree on key parameters.

What is the correct answer to this question?

The correct answer is: Resource group scope — The resource group scope is the correct choice because RBAC permissions apply to all resources inside that group and do not extend to unrelated resources in the subscription. This gives the team enough access to work on the application while keeping other areas isolated. It is the narrowest practical scope when the requirement is to manage everything in one resource group. Why others are wrong: Management group and subscription scopes are too broad because they grant inherited access beyond rg-app. Resource scope is even narrower than necessary and would require extra assignments for each individual resource inside the group. The question asks for access to the whole group, so the group scope is the best fit.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.