The answer is to assign the Virtual Machine Contributor role scoped to the specific resource group. This role grants full VM management—starting, stopping, and restarting—without any permissions to modify networking or storage resources, as those are explicitly excluded from its definition. Scoping the role to the resource group ensures the user cannot alter virtual networks or storage accounts outside the VM’s operational scope, following the principle of least privilege. On the AZ-900 exam, this scenario tests your understanding of built-in role granularity, often appearing as a trap where candidates mistakenly choose a broader role like Contributor. Remember: the VM Contributor role is a “surgical” role—it handles the compute layer only, leaving network and storage untouched. A quick memory tip: “VM Contributor = Compute only, no Net or Store.”
AZ-900 Describe Azure management and governance Practice Question
This AZ-900 practice question tests your understanding of describe azure management and governance. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator needs to grant a user the ability to manage virtual machines in a specific resource group but NOT allow them to modify networking or storage. Which approach is BEST?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "NOT"
Why it matters: Negative qualifier — you are looking for the one option that does NOT apply. Most options will be true; only one is false for this scenario.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Virtual Machine Contributor role scoped to the resource group
The Virtual Machine Contributor role provides exactly the permissions needed to manage virtual machines, including starting, stopping, and restarting them, but explicitly excludes access to the virtual network and storage account resources. By scoping this role to the specific resource group, the administrator ensures the user cannot modify networking or storage resources outside of the VM's operational scope. This is the most precise and secure approach because it follows the principle of least privilege.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Assign Owner role at the subscription level
Why it's wrong here
Owner at subscription level grants full access to everything — far too broad and includes networking and storage.
✓
Assign Virtual Machine Contributor role scoped to the resource group
Why this is correct
Virtual Machine Contributor grants VM management rights only; scoping to the resource group prevents access to other resources.
Clue confirmation
The clue words "NOT", "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Assign Contributor role at the resource group level
Why it's wrong here
Contributor allows full management of all resources in the group, including networking and storage.
✗
Use Azure Policy to restrict the user's actions
Why it's wrong here
Azure Policy enforces governance rules for all users — it's not used to grant permissions to specific users.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the Contributor role (which grants full management of all resources) with the more specific Virtual Machine Contributor role, or they mistakenly think Azure Policy can be used to restrict user permissions when it is actually a governance tool for enforcing resource compliance, not a substitute for RBAC.
Detailed technical explanation
How to think about this question
Azure RBAC uses role definitions that are collections of actions and notActions; the Virtual Machine Contributor role includes actions like Microsoft.Compute/virtualMachines/* but explicitly excludes Microsoft.Network/* and Microsoft.Storage/* via notActions. Scoping is achieved by assigning the role at the resource group level, which creates a role assignment object in Azure AD that is evaluated at runtime by the Azure Resource Manager. In a real-world scenario, this allows a DevOps engineer to manage VMs in a development resource group without risking accidental changes to the shared network or storage infrastructure.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-900 question in full detail.
Describe Azure management and governance — This question tests Describe Azure management and governance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Assign Virtual Machine Contributor role scoped to the resource group — The Virtual Machine Contributor role provides exactly the permissions needed to manage virtual machines, including starting, stopping, and restarting them, but explicitly excludes access to the virtual network and storage account resources. By scoping this role to the specific resource group, the administrator ensures the user cannot modify networking or storage resources outside of the VM's operational scope. This is the most precise and secure approach because it follows the principle of least privilege.
What should I do if I get this AZ-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "NOT", "best". Negative qualifier — you are looking for the one option that does NOT apply. Most options will be true; only one is false for this scenario.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to grant a group of users the ability to restart and start/stop virtual machines, but not to create or delete them. They want to assign this permission at the resource group level. What should they do?
medium
A.Assign the built-in Contributor role
✓ B.Create a custom role with the required actions
C.Assign the built-in Virtual Machine Contributor role
D.Use Azure Policy to restrict operations
Why B: Option B is correct because Azure's built-in roles do not provide a granular permission set that allows restarting and starting/stopping VMs while explicitly denying creation and deletion. A custom role must be created with specific actions such as 'Microsoft.Compute/virtualMachines/start/action', 'Microsoft.Compute/virtualMachines/restart/action', and 'Microsoft.Compute/virtualMachines/deallocate/action', and exclude actions like 'Microsoft.Compute/virtualMachines/write' and 'Microsoft.Compute/virtualMachines/delete'. This custom role can then be assigned at the resource group scope to grant the precise permissions required.
Variation 2. A company needs to grant a specific user the ability to restart virtual machines in a specific resource group, but not to create, delete, or modify them in any other way. The built-in 'Virtual Machine Contributor' role grants too many permissions. What is the most appropriate solution?
hard
✓ A.Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permission
B.Assign the 'Virtual Machine Operator' built-in role
C.Create a custom role with 'Contributor' and then add a deny assignment for delete and create
D.Assign the 'Owner' role and then remove permissions
Why A: Option A is correct because it combines the 'Reader' role (which allows read-only access to all resources) with a custom RBAC role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures the user can restart VMs in the target resource group without being able to create, delete, or modify them, meeting the exact requirement.
Variation 3. A company has a team of support engineers who need to be able to restart Azure virtual machines when they become unresponsive. The support engineers must not be able to modify the VM configuration, delete the VMs, or access VM data. The company wants to use the principle of least privilege. No built-in Azure role meets these exact requirements. What should the company do?
medium
A.Assign the support engineers the Virtual Machine Contributor built-in role.
B.Assign the support engineers the Owner built-in role on the resource group containing the VMs.
✓ C.Create a custom role in Azure RBAC that includes only the 'Microsoft.Compute/virtualMachines/restart/action' permission and assign it to the support engineers.
D.Configure an Azure Policy definition that allows only the restart operation on virtual machines.
Why C: Option C is correct because it adheres to the principle of least privilege by creating a custom role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures support engineers can restart VMs without being able to modify configurations, delete VMs, or access data, which no built-in role provides.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.