AZ-204 Implement Azure security Practice Question
Your company has several Azure subscriptions, and you need to create a custom role that allows security engineers to start and stop Azure virtual machines but not delete them or modify their network interfaces. The role must be scoped to a specific resource group. How should you define this custom role?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy with RBAC, thinking Policy can control runtime actions like start/stop, when in fact Policy only governs resource configuration and compliance, not operational permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with allowed actions for start and stop, and explicitly deny delete actions using NotActions.
Custom roles in Azure RBAC allow you to define granular permissions using Actions and NotActions. To allow start/stop but prevent delete, you can define a broad action like 'Microsoft.Compute/virtualMachines/*' (which includes start/stop and delete) and then use 'NotActions' to explicitly exclude 'Microsoft.Compute/virtualMachines/delete'. Since network interface modifications fall under the 'Microsoft.Network' resource provider, they are not included in 'Microsoft.Compute/virtualMachines/*' and thus are implicitly denied by this role definition. Scoping the role to a specific resource group ensures the permissions apply only to that resource group, meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the built-in Contributor role to the resource group.
Why it's wrong here
The built-in Contributor role grants extensive permissions, allowing full management of all resources within the assigned scope, including the ability to create, update, and delete virtual machines. While it would permit starting and stopping VMs, it also explicitly includes the 'Microsoft.Compute/virtualMachines/delete' action. This level of access significantly exceeds the requirement to only start and stop VMs, and critically fails to prevent deletion, thus violating the principle of least privilege.
- ✓
Create a custom role with allowed actions for start and stop, and explicitly deny delete actions using NotActions.
Why this is correct
Creating a custom Azure RBAC role allows for granular control over permissions, precisely aligning with the principle of least privilege. This role can be configured to include specific actions like 'Microsoft.Compute/virtualMachines/start/action' and 'Microsoft.Compute/virtualMachines/stop/action' within its 'Actions' property. Crucially, by adding 'Microsoft.Compute/virtualMachines/delete' to the 'NotActions' property, the role explicitly denies the ability to delete virtual machines, even if other broad permissions might implicitly grant it. This combination provides the exact required functionality while preventing unintended deletions.
- ✗
Use Azure Policy to prevent deletion of VMs in that resource group.
Why it's wrong here
Azure Policy is a governance tool used to enforce organizational standards and assess compliance, primarily by auditing or denying resource deployments and modifications that violate defined rules. While a policy could effectively prevent the deletion of virtual machines, it does not grant any permissions to perform actions like starting or stopping them. Engineers would still lack the necessary RBAC assignments to manage VM operational states, making Azure Policy an insufficient solution on its own for this requirement.
- ✗
Add the engineers to an Microsoft Entra ID administrative unit and assign permissions for VM operations.
Why it's wrong here
Microsoft Entra ID administrative units are designed to delegate administrative permissions over a subset of Microsoft Entra ID objects, such as users or groups, within a larger tenant. They enable more granular management of identity-related tasks, like password resets or user property updates, by specific administrators. However, administrative units do not extend to managing permissions for Azure resources like virtual machines or resource groups. Azure resource access control is managed exclusively through Azure Role-Based Access Control (RBAC).
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.