An operations team must be able to restart virtual machines in one resource group. They must not create, delete, resize, or change disks or networking. Which two actions should the administrator take? Select two.

Assign the Virtual Machine Contributor role to the operations group.

Virtual Machine Contributor is broader than required and can allow many VM management tasks. It does not follow the least-privilege requirement described in the scenario.

Create an Azure Policy assignment that denies VM creation in the resource group.

Policy can block noncompliant deployments, but it does not grant the team restart access. The requirement is about authorization for operations, not only deployment prevention.

Apply a ReadOnly lock to the resource group.

A ReadOnly lock would block write operations, including VM restarts and other management actions. That would prevent the team from doing the required work.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom RBAC role that includes only read and restart actions for virtual machines. — The correct approach is to create a custom RBAC role containing only the virtual machine read and restart actions, then assign that role to the operations group at the resource group scope. RBAC controls who can perform operations, and a custom role keeps the permission set tightly focused. The resource group scope ensures the team can manage only the VMs in that application boundary and nothing broader. Why others are wrong: Virtual Machine Contributor is too permissive for a restart-only requirement. Azure Policy can restrict deployments, but it does not grant operational authorization. A ReadOnly lock blocks management actions and would stop restarts, so it is the opposite of what the team needs.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.