Based on the exhibit, an automation account must restart virtual machines and read network interface settings in RG-App. Built-in roles are too broad because they also allow actions the team does not want. What should the administrator do?

Assign the Reader role at RG-App, because reading permissions automatically include restart actions.

Reader is too limited for this requirement. It allows viewing resources but does not permit restart actions on virtual machines. The note in the exhibit explicitly says Reader cannot restart VMs, so it cannot satisfy the automation account's task.

Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.

Virtual Machine Contributor includes more permissions than needed, and subscription scope would extend those permissions to every resource group. That would violate the requirement to keep access confined to RG-App and to avoid deletion or broader management capabilities.

Create a management group and move RG-App into it so only the needed actions are exposed.

Management groups organize subscriptions for governance, but they do not reduce permissions in the way described here. Moving a resource group to a management group does not automatically create a narrow permission set. The access problem is solved by a custom RBAC role, not by hierarchy changes.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a custom role with only the required read and restart actions, then assign it at RG-App. — A custom role is the right choice because the required permissions are specific and the built-in roles are either too broad or too limited. The administrator can define exactly the needed read actions plus the restart action, then assign that role at the RG-App scope. This delivers least privilege and keeps the automation account from deleting or modifying unrelated resources. Why others are wrong: Reader cannot restart VMs, so it fails the operational requirement. Virtual Machine Contributor is broader than needed and would allow actions the team explicitly wants to block. Management groups organize governance boundaries, but they do not substitute for a custom permission set. The problem is permissions, not subscription structure.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.