AZ-305 Design infrastructure solutions Practice Question
Exhibit
{
"roleDefinition": {
"Name": "Custom VM Operator",
"Actions": [
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Compute/virtualMachines/deallocate/action",
"Microsoft.Compute/virtualMachines/read"
],
"NotActions": [],
"AssignableScopes": ["/subscriptions/1234-5678"]
}
}Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?
⚠ Common exam trap
Many candidates assume boot diagnostics are a property of the VM itself, when in reality they are stored in a separate storage account that requires explicit permissions beyond the VM scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The role lacks permissions to the diagnostics storage account
Boot diagnostics in Azure require access to a storage account where the serial console output and screenshots are stored. Even if the user has Microsoft.Compute/virtualMachines/read permission on the VM, they must also have the appropriate role (e.g., Storage Blob Data Reader) on the diagnostics storage account to read the boot diagnostics data. Without this, the portal will show an error or blank boot diagnostics pane.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have permission to start or restart the VM
Why it's wrong here
This is not the cause, because the custom role explicitly includes the actions Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/restart/action. Moreover, accessing boot diagnostics does not depend on the VM's current power state or on performing a start/restart operation; the screenshot and serial logs are already persisted to storage. Therefore, despite having start/restart rights, the user still fails because of a different authorization gap.
- ✗
The VM is stopped and deallocated
Why it's wrong here
The VM being stopped and deallocated does not prevent viewing boot diagnostics, because the diagnostics payloads (screenshot and serial log) are written to a storage account that exists independently of the VM lifecycle. Azure retains the data even after deallocation, and the portal reads it from storage, not from the VM. Thus, the power state is irrelevant; the user's lack of storage-scoped permissions is what blocks access.
- ✓
The role lacks permissions to the diagnostics storage account
Why this is correct
Boot diagnostics requires the user to have read access to the storage account that stores the diagnostic data, such as Microsoft.Storage/storageAccounts/listKeys/action or a data-plane reader role on that account. The custom role only grants Compute actions on the VM and omits Storage actions, so the portal cannot retrieve the screenshot from the diagnostics container. This missing storage-scope authorization is the exact reason the boot diagnostics image cannot be viewed.
- ✗
The role does not include Microsoft.Compute/virtualMachines/read
Why it's wrong here
The role actually includes Microsoft.Compute/virtualMachines/read, so this is not a gap. While that read permission is necessary to locate the VM and its diagnostics configuration, it only covers the VM resource itself and not the external storage account where the screenshot is stored. Since read is already present, the missing permission must instead be on the diagnostics storage account.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.