AZ-900 Describe Azure management and governance Practice Question
A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?
⚠ Common exam trap
Watch out — candidates often assume built-in roles like Virtual Machine Contributor are sufficiently restrictive, but they actually include broader permissions (e.g., create, delete, modify) that violate the principle of least privilege when only start/stop/restart is needed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.
The principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the Virtual Machine Contributor built-in role to the developers.
Why it's wrong here
Virtual Machine Contributor provides full management of VMs, including creating, deleting, and modifying VMs, as well as managing networking resources (like virtual networks and network interfaces) attached to VMs. This is too permissive and violates the principle of least privilege because it allows actions beyond starting, stopping, and restarting, and it could also allow modification of virtual networks.
When this WOULD be correct
If the requirement were to grant full management of VMs (including creation and deletion) but not access to other resources like virtual networks or databases, the Virtual Machine Contributor role would be appropriate.
- ✓
Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.
Why this is correct
A custom RBAC role allows you to define a precise set of allowed actions. By including only the start, deallocate, and restart actions, you grant exactly the permissions needed. The role does not include write or delete actions, so developers cannot create or delete VMs. Since VNet and database actions are not included, those resources are also protected. This meets the least privilege requirement.
- ✗
Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.
Why it's wrong here
The Contributor role grants write permissions to all resources, including the ability to create and delete VMs and modify VNets. While Azure Policy can deny the actual creation of resources, it cannot revoke permissions already granted by an RBAC role. Users with Contributor would still have the permission to create resources, and even though the policy denies the action, the user could potentially bypass or the policy might not cover all scenarios. Moreover, the principle of least privilege should be enforced at the RBAC level, not through additional policies. This approach is not a clean RBAC solution.
When this WOULD be correct
A company needs to grant a group of users Contributor-level access to a resource group but must prevent specific actions (e.g., VM creation or VNet modification) that are not allowed by the built-in role. In that case, assigning the Contributor role combined with an Azure Policy to deny those specific actions would be the correct approach.
- ✗
Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.
Why it's wrong here
The Reader role only allows read access to resources; it does not grant any permissions to perform actions like starting, stopping, or restarting VMs. Azure Policy does not grant permissions to execute actions; it enforces rules on resource configuration. To perform actions, users need the appropriate RBAC role assignments. This approach would not give developers the ability to start/stop VMs.
When this WOULD be correct
A scenario where developers need read-only access to resources and an automated schedule (e.g., via Azure Automation) handles VM start/stop operations based on tags or schedules, with no manual intervention required.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.Correct answer▾
Why this is correct
A custom RBAC role allows you to define a precise set of allowed actions. By including only the start, deallocate, and restart actions, you grant exactly the permissions needed. The role does not include write or delete actions, so developers cannot create or delete VMs. Since VNet and database actions are not included, those resources are also protected. This meets the least privilege requirement.
✗Assign the Virtual Machine Contributor built-in role to the developers.Wrong answer — click to see why▾
Why this is wrong here
The Virtual Machine Contributor role allows creating and deleting VMs, which violates the requirement that developers must not create or delete VMs.
★ When this WOULD be the correct answer
If the requirement were to grant full management of VMs (including creation and deletion) but not access to other resources like virtual networks or databases, the Virtual Machine Contributor role would be appropriate.
Why candidates choose this
Candidates may assume that a built-in role named 'Virtual Machine Contributor' is limited to start/stop/restart actions, but it actually includes broader permissions like VM creation and deletion.
✗Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Contributor role grants full management access to all resources in the resource group, including creating and deleting VMs, modifying virtual networks, and accessing the SQL database, which violates the principle of least privilege and exceeds the required permissions.
★ When this WOULD be the correct answer
A company needs to grant a group of users Contributor-level access to a resource group but must prevent specific actions (e.g., VM creation or VNet modification) that are not allowed by the built-in role. In that case, assigning the Contributor role combined with an Azure Policy to deny those specific actions would be the correct approach.
Why candidates choose this
Candidates may think that combining a broad role with a restrictive policy is an efficient way to achieve least privilege without creating a custom role, underestimating the complexity and potential for misconfiguration in policy definitions.
✗Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.Wrong answer — click to see why▾
Why this is wrong here
The Reader role only allows read access, not the ability to start, stop, or restart VMs. Azure Policy cannot perform actions like starting/stopping VMs on behalf of users; it only enforces compliance rules.
★ When this WOULD be the correct answer
A scenario where developers need read-only access to resources and an automated schedule (e.g., via Azure Automation) handles VM start/stop operations based on tags or schedules, with no manual intervention required.
Why candidates choose this
Candidates may think Azure Policy can automate actions, confusing its compliance enforcement with actual execution capabilities, or they may believe Reader plus policy can achieve the desired result without understanding RBAC limitations.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.