AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Only the Reader role from the subscription scope is inherited by the storage account.

  Why it's wrong here

  This option incorrectly assumes that only the highest-level scope applies or that the resource-group assignment is somehow ignored. Azure RBAC assignments are additive: the user holds both a Reader assignment at subscription scope and a Contributor assignment at resource-group scope. Effective permissions are the union of both, so the storage account receives the more permissive Contributor role from RG-Web along with the subscription-level Reader role, not just Reader alone.

  When this WOULD be correct

  This option would be correct if the developer had only the Reader role at the subscription scope and no other assignments at any lower scope (resource group or resource). In that case, the storage account would inherit only the Reader role from the subscription.

• ✓

  The Contributor role from RG-Web is inherited by the storage account.

  Why this is correct

  Azure RBAC permissions are transitive along the scope hierarchy: subscription > resource group > resource. Because the storage account resides in RG-Web, the Contributor role assignment at the resource group scope is inherited by every resource in that group, including the storage account. This grants full management-plane control over the storage account, and it coexists with the broader Reader assignment at the subscription scope without negating it.

• ✗

  Neither role is inherited because storage accounts require a direct assignment.

  Why it's wrong here

  This misunderstanding treats storage accounts like a special resource type that requires a direct assignment, but Azure RBAC inheritance is universal across all resource types. A storage account is a resource within a resource group, so any role assignment at that resource group scope automatically applies to it. No direct, resource-scoped assignment is necessary for inheritance to occur; in fact, direct assignments are simply another layer on top of inherited permissions.

  When this WOULD be correct

  This option would be correct if the question specified that the storage account has a deny assignment or a custom role assignment that blocks inheritance, or if the question asked about a resource type that does not support RBAC inheritance (e.g., classic resources).

• ✗

  Both roles are merged into a new custom role automatically.

  Why it's wrong here

  Azure RBAC never automatically merges or synthesizes role definitions. The Reader and Contributor roles remain separate built-in role definitions, and the user simply has two distinct role assignments at different scopes. Effective permissions are calculated as the union of allowed actions from each assigned role, not by creating a new custom role that combines their names or actions. Custom roles can only be created manually by an administrator, never generated automatically from overlapping assignments.

  When this WOULD be correct

  This option would be correct if the question described a scenario where Azure automatically creates a custom role that combines permissions from multiple assignments, which does not happen in reality. For example, if the question asked 'What happens when a user has two roles assigned?' and the answer claimed automatic merging, it would be wrong; but if the question explicitly stated that Azure creates a custom role, this could be correct in a hypothetical exam context.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question