You want to let a support engineer restart only the virtual machines in the Prod-Apps resource group, and any VM added later to that group should also be covered. Where should you assign the role?

At the subscription scope, because it will cover the resource group and future VMs.

This is broader than needed and grants access to unrelated resource groups in the subscription.

At each VM resource scope, because role assignments never inherit.

This is incorrect because Azure RBAC does inherit from resource group scope to child resources. Per-VM assignments would create unnecessary administrative overhead.

At the management group scope, because it is the only scope that applies to VMs.

This is incorrect because management group scope is far too broad for a single resource group and is not required for this task.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: At the Prod-Apps resource group scope, because the assignment will inherit to all VMs in that group. — The best scope is the resource group. Azure RBAC uses inheritance, so a role assigned to the resource group applies to all VMs inside it, including VMs that are created later. This gives the engineer exactly the needed access while avoiding a broader subscription-level assignment and avoiding repeated VM-by-VM role assignments. Why others are wrong: Subscription and management group scopes are too broad for a single application group and can expose unrelated resources. Assigning at each VM scope would work but creates avoidable maintenance and risks missing new VMs. The resource group scope is the narrowest practical choice that still satisfies the requirement.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.