AZ-500 Manage identity and access Practice Question
A custom Azure role should allow operators to restart virtual machines but not delete them or change networking. Which permission design is most appropriate?
⚠ Common exam trap
Many candidates confuse built-in roles like Contributor or Virtual Machine Contributor with the ability to restrict actions, not realizing these roles include delete and network write permissions that exceed the narrow restart-only requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with Microsoft.Compute/virtualMachines/restart/action and required read permissions at the narrowest scope
It grants the specific 'restart/action' permission on virtual machines while excluding destructive actions like delete or network changes. Custom roles in Azure RBAC allow fine-grained control by including only the required data actions and read permissions, ensuring operators can restart VMs without the ability to delete them or modify networking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Contributor at the resource group scope
Why it's wrong here
Assigning Contributor at the resource group scope technically includes the restart action via the wildcard *, so it would enable restarts. However, Contributor also grants full management rights to create, delete, and modify every resource in the resource group, including all VMs, disks, and networking components, which severely violates the principle of least privilege. Instead of narrowly permitting a specific restart action, you are giving operators broad write access to an entire collection of resources.
- ✓
Create a custom role with Microsoft.Compute/virtualMachines/restart/action and required read permissions at the narrowest scope
Why this is correct
This is the correct approach because a custom role definition containing exactly Microsoft.Compute/virtualMachines/restart/action and Microsoft.Compute/virtualMachines/read provides only the control-plane action needed to restart a VM and the read permission required for the resource to be displayed and identified in Azure. By then assigning this custom role at the narrowest scope, such as the specific virtual machine resource, you guarantee operators cannot affect any other VM or resource. This satisfies the stated requirement while adhering to least privilege and is the most direct, security-focused solution.
- ✗
Assign Virtual Machine Contributor at subscription scope
Why it's wrong here
The Virtual Machine Contributor built-in role does include Microsoft.Compute/virtualMachines/restart/action, but it also allows creating, deleting, and managing all supporting resources like disks, network interfaces, and extensions. Assigning it at subscription scope means the operator gains this elevated access to every virtual machine and related resource across the entire subscription, which is vastly more permissive than restarting a single VM. This option fails to isolate the operator to the specific VM and introduces unnecessary risk across the whole environment.
- ✗
Assign Reader and ask operators to use Run Command
Why it's wrong here
The Reader role is strictly read-only and does not include the restart action, so operators cannot restart a VM with this role alone. Asking them to use Run Command would require an additional role assignment for Microsoft.Compute/virtualMachines/runCommand/action, and Run Command is a far more powerful capability that permits executing arbitrary scripts with elevated privileges—something much riskier than a simple restart. Moreover, Run Command is intended for interactive troubleshooting, not as a replacement for the explicit restart permission, so this method is both incomplete and dangerous.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.