AZ-204 Implement Azure security Practice Question
You need to create a custom RBAC role that allows a security group to start and stop Azure virtual machines in a specific resource group, but not delete them or modify their network interfaces. Which set of actions should you include in the role definition?
⚠ Common exam trap
A common mix-up: candidates confuse 'powerOff' (which stops the VM but keeps it allocated and billable) with 'deallocate' (which stops and releases resources), leading them to choose Option B instead of the correct deallocate action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action
The custom RBAC role needs to allow starting and stopping (deallocating) VMs without permitting deletion or network interface modifications. The actions Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action precisely grant the ability to start a VM and deallocate it (which stops and releases resources), while excluding delete or write permissions on the VM or its network interfaces.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/deallocate/action
Why this is correct
This combination correctly grants the precise permissions required to start and stop Azure Virtual Machines. The Microsoft.Compute/virtualMachines/start/action allows powering on a VM from a stopped or deallocated state. Conversely, Microsoft.Compute/virtualMachines/deallocate/action stops the VM and releases its associated compute resources, which is the standard and most cost-effective "stop" operation in Azure. These actions adhere to the principle of least privilege by not including permissions for deletion or configuration changes.
- ✗
Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/powerOff/action
Why it's wrong here
The action Microsoft.Compute/virtualMachines/powerOff/action is not a valid or recognized RBAC permission within Azure. Azure RBAC actions are explicitly defined by resource providers, and for stopping a virtual machine and releasing its compute resources, the correct and granular action is Microsoft.Compute/virtualMachines/deallocate/action. Therefore, including a non-existent action makes this custom role definition fundamentally flawed and ineffective for its intended purpose.
- ✗
Microsoft.Compute/virtualMachines/restart/action and Microsoft.Compute/virtualMachines/deallocate/action
Why it's wrong here
While Microsoft.Compute/virtualMachines/deallocate/action is correct for stopping a VM, Microsoft.Compute/virtualMachines/restart/action only allows rebooting an already running virtual machine. It does not provide the capability to power on a VM that is currently in a stopped or deallocated state. To fulfill the requirement of "starting" a VM, the Microsoft.Compute/virtualMachines/start/action is explicitly necessary, rendering this option incomplete for the specified task.
- ✗
Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/write
Why it's wrong here
The Microsoft.Compute/virtualMachines/write action is excessively broad and grants permissions to modify virtually any property of a virtual machine, including its configuration, network interfaces, and even deletion. While it implicitly covers the ability to start a VM, it violates the principle of least privilege by allowing far more control than just starting and stopping. This level of access could lead to unintended or malicious changes, making it an insecure choice for a limited start/stop requirement.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.