AZ-900 Describe Azure management and governance Practice Question
A company needs to grant a specific user the ability to restart virtual machines in a specific resource group, but not to create, delete, or modify them in any other way. The built-in 'Virtual Machine Contributor' role grants too many permissions. What is the most appropriate solution?
⚠ Common exam trap
A common mix-up: candidates assume a built-in role like 'Virtual Machine Operator' is the most appropriate because it sounds specific, but it actually includes more permissions than needed, and the correct solution requires creating a custom role with the exact action required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permission
It combines the 'Reader' role (which allows read-only access to all resources) with a custom RBAC role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures the user can restart VMs in the target resource group without being able to create, delete, or modify them, meeting the exact requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permission
Why this is correct
Assigning the Reader role grants the user read-only visibility to all resources in the scope, which satisfies the 'see' aspect of the requirement. Then, adding a custom RBAC role that contains only the Microsoft.Compute/virtualMachines/restart/action permission narrowly grants just the restart action without exposing any other management operations. Combining these two assignments delivers exactly the requested capability—viewing virtual machines and restarting them—while strictly adhering to the principle of least privilege.
- ✗
Assign the 'Virtual Machine Operator' built-in role
Why it's wrong here
The Virtual Machine Operator built-in role is too permissive for this task because it not only includes the virtualMachines/restart/action but also permissions to start, stop, and deallocate virtual machines, reset passwords, and manage virtual machine extensions. While it does not grant full administrative control like Owner, it still exceeds the minimal set of actions the user needs. Granting this role would allow the user to perform operations beyond restarting, violating the least-privilege principle and unnecessarily expanding the potential for accidental or malicious changes.
When this WOULD be correct
This option would be correct if the question required granting a user the ability to start, stop, and restart virtual machines (but not create, delete, or modify configurations), as the 'Virtual Machine Operator' role provides exactly those permissions.
- ✗
Create a custom role with 'Contributor' and then add a deny assignment for delete and create
Why it's wrong here
Creating a custom role with 'Contributor' initially grants excessive permissions, violating the principle of least privilege. Deny assignments prevent specific actions, but they are not the mechanism for defining a precise, minimal set of allowed permissions from the outset. This approach starts too broadly for the required granular control. Deny assignments are instead valuable for enforcing organisational policies, such as preventing deletion of critical resources across a scope, overriding permissions granted by other role assignments, which is where they would be the correct choice.
When this WOULD be correct
This approach would be correct if the question required granting broad management permissions (like Contributor) but explicitly blocking specific actions (e.g., delete) for a subset of resources, where deny assignments are needed to override inherited allow permissions.
- ✗
Assign the 'Owner' role and then remove permissions
Why it's wrong here
Assigning the Owner role gives the user full management access to all resources in the scope, including the ability to assign roles, delete resources, and modify access policies. When you assign a built-in role like Owner, you cannot 'remove' or finely prune individual permissions—the role definition is fixed and every action it contains is always enabled. Any attempt to restrict Owner would require creating a custom role or using a deny assignment, but starting from Owner is fundamentally incorrect for a request that requires only restart permission; it grants far too many administrative capabilities, including role assignments that could compromise the entire resource hierarchy.
When this WOULD be correct
This approach would be correct if the question asked for a solution to grant a user full control over all resources in a subscription, including the ability to manage access and all operations, without any restrictions. For example, 'A new administrator needs complete control over all Azure resources and user access.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permissionCorrect answer▾
Why this is correct
Assigning the Reader role grants the user read-only visibility to all resources in the scope, which satisfies the 'see' aspect of the requirement. Then, adding a custom RBAC role that contains only the Microsoft.Compute/virtualMachines/restart/action permission narrowly grants just the restart action without exposing any other management operations. Combining these two assignments delivers exactly the requested capability—viewing virtual machines and restarting them—while strictly adhering to the principle of least privilege.
✗Assign the 'Virtual Machine Operator' built-in roleWrong answer — click to see why▾
Why this is wrong here
The 'Virtual Machine Operator' built-in role includes permissions beyond just restart, such as start, stop, and reset password, which violates the requirement to only allow restart.
★ When this WOULD be the correct answer
This option would be correct if the question required granting a user the ability to start, stop, and restart virtual machines (but not create, delete, or modify configurations), as the 'Virtual Machine Operator' role provides exactly those permissions.
Why candidates choose this
Candidates may assume 'Operator' roles are narrowly scoped to operational tasks like restart, without realizing they include additional actions like start and stop.
✗Create a custom role with 'Contributor' and then add a deny assignment for delete and createWrong answer — click to see why▾
Why this is wrong here
Adding a deny assignment to a 'Contributor' role is overly complex and not the most appropriate solution; Azure RBAC supports custom roles with specific actions, making deny assignments unnecessary for this granular permission requirement.
★ When this WOULD be the correct answer
This approach would be correct if the question required granting broad management permissions (like Contributor) but explicitly blocking specific actions (e.g., delete) for a subset of resources, where deny assignments are needed to override inherited allow permissions.
Why candidates choose this
Candidates may think combining a broad role with a deny assignment is a straightforward way to restrict permissions, not realizing that custom roles can directly specify allowed actions without needing deny rules.
✗Assign the 'Owner' role and then remove permissionsWrong answer — click to see why▾
Why this is wrong here
Assigning the 'Owner' role grants full access to all resources, including the ability to create, delete, and modify virtual machines, which exceeds the required permission to only restart VMs. Removing permissions from the Owner role is not a supported or recommended practice in Azure RBAC.
★ When this WOULD be the correct answer
This approach would be correct if the question asked for a solution to grant a user full control over all resources in a subscription, including the ability to manage access and all operations, without any restrictions. For example, 'A new administrator needs complete control over all Azure resources and user access.'
Why candidates choose this
Candidates may think that assigning a broad role and then removing specific permissions is a flexible way to achieve least privilege, but Azure RBAC does not support removing permissions from built-in roles; instead, custom roles should be created.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Resource Locks and Tags
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.