AZ-104 Manage Azure Identities and Governance Practice Question
An operations team must be able to restart virtual machines in one resource group. They must not create, delete, resize, or change disks or networking. Which two actions should the administrator take? Select two.
⚠ Common exam trap
Candidates often confuse Azure Policy (which enforces compliance rules) with RBAC (which controls permissions), or mistakenly think a ReadOnly lock still allows restart actions, not realizing that restart is a write operation in the Azure Resource Manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom RBAC role that includes only read and restart actions for virtual machines.
A custom RBAC role can be defined to include only the 'Microsoft.Compute/virtualMachines/read' and 'Microsoft.Compute/virtualMachines/restart/action' permissions, which precisely limits the operations team to reading and restarting VMs without allowing create, delete, resize, or disk/network changes. This aligns with the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom RBAC role that includes only read and restart actions for virtual machines.
Why this is correct
A custom RBAC role can be defined with precisely the needed permissions. The role definition JSON includes the actions Microsoft.Compute/virtualMachines/read and Microsoft.Compute/virtualMachines/restart/action, which together allow the team to view and restart VMs without any other management capabilities such as creating, deleting, or modifying them. Because no built-in role offers only these two actions, creating a custom role is necessary to achieve least privilege.
- ✗
Assign the Virtual Machine Contributor role to the operations group.
Why it's wrong here
The Virtual Machine Contributor built-in role grants a broad set of VM management permissions, including the ability to create, delete, start, stop, and restart virtual machines, as well as manage their disks and network interfaces. This role goes well beyond the required read and restart actions and would allow the operations team to make changes that are not permitted in the least-privilege model. Additionally, it can enable a user to grant another user access to the VM, which is an unnecessary security risk in this scenario.
When this WOULD be correct
This option would be correct if the requirement was to allow full management of virtual machines (including create, delete, resize, and disk/network changes) but not access to the VM's data or other resources in the resource group.
- ✓
Assign the custom role to the operations group at the resource group scope.
Why this is correct
Assigning the role at the resource group scope ensures that permissions are inherited by every virtual machine inside that resource group, so the operations team can restart any VM in that boundary. This scoping also prevents the team from affecting resources in other resource groups or subscriptions, keeping the access boundary aligned with the application's environment. The assignment associates the custom role with the security principal (the operations group), and all group members automatically receive the permissions.
- ✗
Create an Azure Policy assignment that denies VM creation in the resource group.
Why it's wrong here
Azure Policy is a governance mechanism that enforces rules on resource configurations during creation or update; it does not grant permissions to perform existing resource operations. A policy denying VM creation would only prevent new VMs from being deployed and would have no effect on whether an existing VM can be restarted. Restart authorization is controlled solely by RBAC actions, so the operations team would still lack the required Microsoft.Compute/virtualMachines/restart/action permission.
When this WOULD be correct
If the question asked: 'The team must prevent any new VMs from being created in the resource group while allowing existing VMs to be managed. Which action should the administrator take?' then creating an Azure Policy assignment that denies VM creation would be correct.
- ✗
Apply a ReadOnly lock to the resource group.
Why it's wrong here
A ReadOnly lock is an Azure resource lock that prevents any user from performing write operations on the resource group, regardless of their RBAC role assignments. Restarting a VM is a control-plane write operation that issues a POST to Microsoft.Compute/virtualMachines/restart, so it would be blocked by the lock. The lock would also block other management tasks like starting, stopping, or deleting resources, thus the operations team would be unable to perform the required restart action at all.
When this WOULD be correct
If the question required preventing any modifications (including restarts) to resources in a resource group while allowing read access, applying a ReadOnly lock would be correct. For example, 'You need to ensure that no one can modify or restart VMs in a critical resource group.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom RBAC role that includes only read and restart actions for virtual machines.Correct answer▾
Why this is correct
A custom RBAC role can be defined with precisely the needed permissions. The role definition JSON includes the actions Microsoft.Compute/virtualMachines/read and Microsoft.Compute/virtualMachines/restart/action, which together allow the team to view and restart VMs without any other management capabilities such as creating, deleting, or modifying them. Because no built-in role offers only these two actions, creating a custom role is necessary to achieve least privilege.
✗Assign the Virtual Machine Contributor role to the operations group.Wrong answer — click to see why▾
Why this is wrong here
The Virtual Machine Contributor role allows creating, deleting, and resizing VMs, as well as modifying disks and networking, which exceeds the required permissions of only restarting VMs.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to allow full management of virtual machines (including create, delete, resize, and disk/network changes) but not access to the VM's data or other resources in the resource group.
Why candidates choose this
Candidates may think 'Contributor' implies limited permissions, but it actually grants broad management capabilities, leading them to overlook the specific restrictions needed.
✗Create an Azure Policy assignment that denies VM creation in the resource group.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy assignments deny or audit resource creation based on rules, but they do not grant or restrict actions for existing resources like restarting VMs. The question requires a role-based solution to allow restarting VMs, not a policy to deny creation.
★ When this WOULD be the correct answer
If the question asked: 'The team must prevent any new VMs from being created in the resource group while allowing existing VMs to be managed. Which action should the administrator take?' then creating an Azure Policy assignment that denies VM creation would be correct.
Why candidates choose this
Candidates may confuse Azure Policy with RBAC, thinking that a deny policy can also restrict actions on existing resources, or they may believe that preventing creation indirectly solves the permission issue.
✗Apply a ReadOnly lock to the resource group.Wrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents any changes to resources, including restarting VMs, which requires write access. The operations team needs to restart VMs, so this lock would block their required action.
★ When this WOULD be the correct answer
If the question required preventing any modifications (including restarts) to resources in a resource group while allowing read access, applying a ReadOnly lock would be correct. For example, 'You need to ensure that no one can modify or restart VMs in a critical resource group.'
Why candidates choose this
Candidates may think a ReadOnly lock is a simple way to restrict operations, but they overlook that restarting a VM requires write-level permissions, which the lock denies.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID Users and Groups
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.