AZ-204 Implement Azure security Practice Question
Network Topology
Refer to the exhibit. An administrator runs this Azure CLI command. What is the result?
⚠ Common exam trap
Many exam-takers confuse the `--assignee` parameter with a user principal name (UPN) or fail to recognize that the object ID in the command refers to a service principal, leading them to incorrectly select Option C (user at subscription scope) or Option A (Contributor role).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assigns the Reader role to a service principal at the resource group scope
The Azure CLI command `az role assignment create --assignee <object-id> --role Reader --resource-group <rg-name>` assigns the Reader role to a service principal (identified by its object ID) at the specified resource group scope. The Reader role grants read-only access to resources within that resource group, which matches the command's parameters and the expected outcome.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assigns the Contributor role to a service principal at the resource group scope
Why it's wrong here
The command explicitly specifies `--role "Reader"`, which grants read-only access to Azure resources within the defined scope. The Contributor role, which allows managing all resources but not assigning roles, would require `--role "Contributor"` in the command. Therefore, this option incorrectly identifies the specific role being assigned, as the command clearly specifies 'Reader' and not 'Contributor'.
- ✗
Assigns a managed identity to the resource group
Why it's wrong here
The `az role assignment create` command is designed to grant specific permissions (roles) to an existing identity, not to create or assign a managed identity itself. Assigning a managed identity to an Azure resource, such as a virtual machine or app service, typically involves a different set of commands like `az vm identity assign` or `az webapp identity assign`. This option fundamentally misinterprets the purpose and functionality of the role assignment command.
- ✗
Assigns the Reader role to a user at the subscription scope
Why it's wrong here
The command includes the `--resource-group "myResourceGroup"` parameter, which explicitly defines the scope of the role assignment as a specific resource group. To assign a role at the subscription scope, the command would need to use `--scope "/subscriptions/{subscriptionId}"` instead. Additionally, while a user can be an assignee, the `--assignee` parameter in this context typically refers to a service principal's object ID, making the 'user' part less precise, but the scope is the primary error.
- ✓
Assigns the Reader role to a service principal at the resource group scope
Why this is correct
The `az role assignment create` command, when used with an assignee identifier (like a service principal's object ID), correctly targets a service principal, which is an identity used by applications or services. The `--role "Reader"` parameter accurately specifies that read-only access is being granted. Furthermore, the `--resource-group "myResourceGroup"` parameter correctly sets the scope of this access to a specific resource group, precisely matching the command's intended functionality.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.