Question 1 of 1,031

Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to create a custom RBAC role that includes only the specific actions for starting, stopping, and restarting VMs, then assign it to the developers scoped to the RG-Prod resource group. This is correct because the principle of least privilege demands granting only the exact permissions needed, and built-in roles like Virtual Machine Contributor include broader actions such as creating or deleting VMs, which violates the requirement. On the Microsoft Azure Fundamentals AZ-900 exam, this scenario tests your understanding of custom RBAC roles versus built-in roles, often appearing as a trap where candidates mistakenly choose Virtual Machine Contributor for its convenience. The key distinction is that custom roles allow you to define granular actions like Microsoft.Compute/virtualMachines/start/action, while built-in roles bundle many permissions. For a memory tip, think of the phrase “Custom cuts, built-in bundles”—custom roles let you carve out only what’s needed, ensuring no extra access to networks or databases.

AZ-900 Describe Azure management and governance Practice Question

This AZ-900 practice question tests your understanding of describe azure management and governance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "least"
Why it matters: You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.

Question 1mediummultiple choice

Full question →

A
Assign the Virtual Machine Contributor built-in role to the developers.
Why wrong: Virtual Machine Contributor provides full management of VMs, including creating, deleting, and modifying VMs, as well as managing networking resources (like virtual networks and network interfaces) attached to VMs. This is too permissive and violates the principle of least privilege because it allows actions beyond starting, stopping, and restarting, and it could also allow modification of virtual networks.
B
Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.
A custom RBAC role allows you to define a precise set of allowed actions. By including only the start, deallocate, and restart actions, you grant exactly the permissions needed. The role does not include write or delete actions, so developers cannot create or delete VMs. Since VNet and database actions are not included, those resources are also protected. This meets the least privilege requirement.
C
Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.
Why wrong: The Contributor role grants write permissions to all resources, including the ability to create and delete VMs and modify VNets. While Azure Policy can deny the actual creation of resources, it cannot revoke permissions already granted by an RBAC role. Users with Contributor would still have the permission to create resources, and even though the policy denies the action, the user could potentially bypass or the policy might not cover all scenarios. Moreover, the principle of least privilege should be enforced at the RBAC level, not through additional policies. This approach is not a clean RBAC solution.
D
Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.
Why wrong: The Reader role only allows read access to resources; it does not grant any permissions to perform actions like starting, stopping, or restarting VMs. Azure Policy does not grant permissions to execute actions; it enforces rules on resource configuration. To perform actions, users need the appropriate RBAC role assignments. This approach would not give developers the ability to start/stop VMs.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.

Option B is correct because the principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign the Virtual Machine Contributor built-in role to the developers.
Why it's wrong here
Virtual Machine Contributor provides full management of VMs, including creating, deleting, and modifying VMs, as well as managing networking resources (like virtual networks and network interfaces) attached to VMs. This is too permissive and violates the principle of least privilege because it allows actions beyond starting, stopping, and restarting, and it could also allow modification of virtual networks.
✓
Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.
Why this is correct
A custom RBAC role allows you to define a precise set of allowed actions. By including only the start, deallocate, and restart actions, you grant exactly the permissions needed. The role does not include write or delete actions, so developers cannot create or delete VMs. Since VNet and database actions are not included, those resources are also protected. This meets the least privilege requirement.
Clue confirmation
The clue word "least" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.
Why it's wrong here
The Contributor role grants write permissions to all resources, including the ability to create and delete VMs and modify VNets. While Azure Policy can deny the actual creation of resources, it cannot revoke permissions already granted by an RBAC role. Users with Contributor would still have the permission to create resources, and even though the policy denies the action, the user could potentially bypass or the policy might not cover all scenarios. Moreover, the principle of least privilege should be enforced at the RBAC level, not through additional policies. This approach is not a clean RBAC solution.
✗
Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.
Why it's wrong here
The Reader role only allows read access to resources; it does not grant any permissions to perform actions like starting, stopping, or restarting VMs. Azure Policy does not grant permissions to execute actions; it enforces rules on resource configuration. To perform actions, users need the appropriate RBAC role assignments. This approach would not give developers the ability to start/stop VMs.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often assume built-in roles like Virtual Machine Contributor are sufficiently restrictive, but they actually include broader permissions (e.g., create, delete, modify) that violate the principle of least privilege when only start/stop/restart is needed.

Trap categories for this question

Scenario analysis trap
The Contributor role grants write permissions to all resources, including the ability to create and delete VMs and modify VNets. While Azure Policy can deny the actual creation of resources, it cannot revoke permissions already granted by an RBAC role. Users with Contributor would still have the permission to create resources, and even though the policy denies the action, the user could potentially bypass or the policy might not cover all scenarios. Moreover, the principle of least privilege should be enforced at the RBAC level, not through additional policies. This approach is not a clean RBAC solution.

Detailed technical explanation

How to think about this question

Azure RBAC uses role definitions that are collections of actions (e.g., Microsoft.Compute/virtualMachines/start/action) and notActions. Custom roles are defined as JSON and can be scoped to a management group, subscription, resource group, or individual resource. In this scenario, the custom role should also include Microsoft.Compute/virtualMachines/read to allow listing VMs, as start/stop/restart actions require read permission to discover the VM resource. The role must be assigned at the RG-Prod scope to limit the developers' access to only that resource group.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related AZ-900 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Describe cloud concepts practice questions

Practise AZ-900 questions linked to Describe cloud concepts.

Describe Azure architecture and services practice questions

Practise AZ-900 questions linked to Describe Azure architecture and services.

Describe Azure management and governance practice questions

Practise AZ-900 questions linked to Describe Azure management and governance.

AZ-900 Azure services practice questions

Practise AZ-900 questions linked to AZ-900 Azure services.

AZ-900 pricing and support practice questions

Practise AZ-900 questions linked to AZ-900 pricing and support.

AZ-900 security and compliance practice questions

Practise AZ-900 questions linked to AZ-900 security and compliance.

AZ-900 governance practice questions

Practise AZ-900 questions linked to AZ-900 governance.

Practice this exam

Start a free AZ-900 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

AZ-900 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AZ-900 question test?

Describe Azure management and governance — This question tests Describe Azure management and governance — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers. — Option B is correct because the principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

What should I do if I get this AZ-900 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "least". You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.