AZ-900 Describe Azure management and governance Practice Question
Which Azure RBAC built-in role allows a user to view all resources but NOT make any changes?
⚠ Common exam trap
Watch out — candidates often confuse the Contributor role (which can view and modify) with the Reader role, or mistakenly think the User Access Administrator role provides read-only access to resources instead of just managing permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reader
The Reader role is the correct answer because it grants read-only access to all Azure resources, including their properties and status, but explicitly prevents any modifications, deletions, or creations. This aligns directly with the requirement to view resources without making changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Contributor
Why it's wrong here
Contributor is a built-in RBAC role that allows a user to create, manage, and delete all resources within the assigned scope, but it does not permit granting access to others. Because this role includes full write and delete permissions, it is far broader than a read-only requirement. A user assigned Contributor could modify or remove resources, so it is incorrect for a task that only asks for viewing resources.
- ✗
Owner
Why it's wrong here
Owner is the most permissive RBAC built-in role, granting full access to all resources and the ability to manage role assignments, including delegating access to other users. With Owner, a user can change permissions, delete resources, and perform any management action, which completely exceeds the need to only view resources. This role is therefore not suitable when the requirement is strictly read-only.
- ✓
Reader
Why this is correct
Reader is the correct built-in RBAC role because it grants view-only access to resources within the assigned scope, allowing a user to see resource properties, settings, and some data without being able to create, update, or delete anything. This role aligns with the principle of least privilege and is specifically designed for monitoring, auditing, or reporting scenarios where no modifications are required.
- ✗
User Access Administrator
Why it's wrong here
User Access Administrator is an RBAC role focused on managing user access to Azure resources; it allows the holder to assign roles, grant permissions, and manage role-based access control at a given scope. This role does not inherently include the ability to read resource data or view resource configurations, and it certainly does not provide read-only access. Since the task is about viewing resources, not managing permissions, this role is inappropriate.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.