Implement Azure security →easyMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

Exhibit

{
  "type": "Microsoft.Authorization/roleDefinitions",
  "properties": {
    "roleName": "Custom SQL DB Reader",
    "description": "Read-only access to Azure SQL Database",
    "permissions": [
      {
        "actions": [
          "Microsoft.Sql/servers/databases/read"
        ],
        "notActions": []
      }
    ],
    "assignableScopes": [
      "/subscriptions/12345678-1234-1234-1234-123456789abc"
    ]
  }
}

Refer to the exhibit. You created a custom RBAC role definition. A user assigned this role at the subscription scope. What can the user do?

⚠ Common exam trap

Candidates often assume a 'read' action at the subscription scope implies read access to all resource types, but RBAC requires explicit action definitions for each resource provider, and Azure SQL Database read permissions are specific to the 'Microsoft.Sql' namespace.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Read Azure SQL Database configurations and data

The custom RBAC role definition includes the 'Microsoft.Sql/servers/databases/read' action, which grants read access to Azure SQL Database configurations and data at the subscription scope. This action allows the user to view database settings and query data, but does not permit write or create operations.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Read any resource in the subscription
Why it's wrong here
The custom RBAC role definition is specifically designed to grant permissions related to Azure SQL Databases, as indicated by its intended purpose. Therefore, even if the role assignment were at the subscription level, the role's defined actions would restrict its effective permissions solely to SQL Database resources. It would not encompass read access to *any* other resource types within the subscription, such as virtual machines, storage accounts, or network components, because the role definition itself does not include those resource provider actions.
✗
Write to Azure SQL Databases
Why it's wrong here
To enable write operations on Azure SQL Databases, the custom RBAC role definition would need to explicitly include specific write actions, such as "Microsoft.Sql/servers/databases/write" or other granular actions like "Microsoft.Sql/servers/databases/firewallRules/write". The problem statement implies that the role's purpose is not to modify resources. Without these explicit write permissions defined within the role, users assigned this role would be unable to make any changes to SQL Database configurations or data.
✓
Read Azure SQL Database configurations and data
Why this is correct
This custom RBAC role is designed to provide read-only access to Azure SQL Databases. This typically includes actions like "Microsoft.Sql/servers/databases/read" for general database properties, "Microsoft.Sql/servers/databases/metrics/read" for performance data, and potentially "Microsoft.Sql/servers/databases/transparentDataEncryption/read" for security settings. Such permissions allow users to view database configurations, monitor performance, and query data without the ability to modify the database or its underlying infrastructure.
✗
Create new Azure SQL Databases
Why it's wrong here
Creating new Azure SQL Databases requires specific "write" permissions at the scope where the database would be provisioned, typically "Microsoft.Sql/servers/databases/write" at the server level or "Microsoft.Sql/servers/write" at the resource group level to create a new server and then databases. A custom role intended for read-only access to existing databases would not include these provisioning actions. Therefore, users assigned this role would lack the necessary permissions to provision new database instances.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper

AZ-204 Implement Azure security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Access Control Model Comparison

Related to this question