AZ-900 Describe Azure management and governance Practice Question
What is Azure Role-Based Access Control (RBAC)?
⚠ Common exam trap
It's easy for candidates to confuse authentication (Azure AD, MFA) with authorization (RBAC), often selecting Option A because they think 'access control' includes verifying who you are, but RBAC only governs what you can do after authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system for granting specific permissions to users and groups for Azure resources
Azure Role-Based Access Control (RBAC) is an authorization system built on Azure Resource Manager that enables fine-grained access management for Azure resources. It works by assigning roles (collections of permissions) to users, groups, service principals, or managed identities at a specific scope (management group, subscription, resource group, or resource). This allows you to grant only the necessary permissions (e.g., 'Reader' to view resources, 'Contributor' to create and manage them) without sharing account credentials or using a single authentication method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A way to authenticate users to Azure using passwords and MFA
Why it's wrong here
This describes authentication performed by Microsoft Entra ID (formerly Azure Active Directory), which verifies a user's identity using passwords, MFA, conditional access, or federated sign-in. RBAC is entirely separate: it is the authorization step that happens after authentication, deciding what the now-verified identity is allowed to do on specific Azure resources. Confusing the two is common, but authentication answers 'who are you?' while RBAC answers 'what can you do here?'; even a successfully authenticated user receives no permissions unless a role assignment exists.
- ✓
A system for granting specific permissions to users and groups for Azure resources
Why this is correct
Azure RBAC is an authorization system built on Azure Resource Manager that grants access to users, groups, service principals, and managed identities via role assignments. A role assignment binds a role definition (e.g., Reader, Contributor, Owner) to a security principal at a specific scope: management group, subscription, resource group, or individual resource. This enables fine-grained permission control following the principle of least privilege, without sharing account credentials or writing custom authentication logic.
- ✗
A tool for monitoring resource usage and performance
Why it's wrong here
This describes Azure Monitor, not RBAC. Azure Monitor collects and analyzes telemetry from resources, such as CPU utilization, request rates, and failure logs, producing metrics, logs, and alerts to surface performance problems. RBAC, in contrast, is purely about which identities are allowed to perform control-plane and data-plane actions on resources; it does not observe resource health or operational behavior. A monitoring tool cannot replace the access-management decisions made by role assignments.
- ✗
A service for encrypting data stored in Azure
Why it's wrong here
Data encryption in Azure is handled by technologies like Storage Service Encryption, Azure Disk Encryption, and Azure Key Vault for key management, not by RBAC. RBAC never transforms or encrypts data; it governs whether a principal has read, write, or delete permission to a resource. While RBAC can protect access to encryption keys and secrets stored in Key Vault, granting or denying that access is not the same as performing the cryptographic operation. Encryption protects data at rest and in transit; RBAC determines who can reach the data at all.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.