AZ-900 Describe Azure management and governance Practice Question
A company has a team of support engineers who need to be able to restart Azure virtual machines when they become unresponsive. The support engineers must not be able to modify the VM configuration, delete the VMs, or access VM data. The company wants to use the principle of least privilege. No built-in Azure role meets these exact requirements. What should the company do?
⚠ Common exam trap
It's easy for candidates to assume the Virtual Machine Contributor role is sufficient for restarting VMs, overlooking that it also grants broader management permissions that violate the principle of least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role in Azure RBAC that includes only the 'Microsoft.Compute/virtualMachines/restart/action' permission and assign it to the support engineers.
It adheres to the principle of least privilege by creating a custom role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures support engineers can restart VMs without being able to modify configurations, delete VMs, or access data, which no built-in role provides.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the support engineers the Virtual Machine Contributor built-in role.
Why it's wrong here
The Virtual Machine Contributor built-in role is designed for full lifecycle management of virtual machines, allowing users to create, delete, start, stop, and restart VMs, as well as manage VM extensions, disks, and network interfaces. While it does include the restart/action permission, it also includes many other write/delete actions such as Microsoft.Compute/virtualMachines/delete and Microsoft.Compute/virtualMachines/write. This violates the principle of least privilege because the support engineers would receive far more capability than the single restart action they actually need.
When this WOULD be correct
If the requirement were to allow support engineers to restart VMs and also manage VM configurations (e.g., resize, update), but not delete VMs or access data, then Virtual Machine Contributor would be appropriate.
- ✗
Assign the support engineers the Owner built-in role on the resource group containing the VMs.
Why it's wrong here
The Owner built-in role on a resource group grants full administrative control over all resources in that scope, including permissions to delete any virtual machine, modify all resource settings, and assign roles to other users. Critically, it includes Microsoft.Authorization role assignment actions (e.g., Microsoft.Authorization/roleAssignments/write), which lets the support engineers grant themselves or others elevated access. A restart-only task requires only the Microsoft.Compute/virtualMachines/restart/action permission, so Owner massively exceeds least privilege and introduces serious security and compliance risks.
When this WOULD be correct
If the question required granting full administrative control over the resource group and its resources, such as allowing a team to manage all aspects of VMs including configuration changes and deletions, then the Owner role would be appropriate.
- ✓
Create a custom role in Azure RBAC that includes only the 'Microsoft.Compute/virtualMachines/restart/action' permission and assign it to the support engineers.
Why this is correct
Creating a custom role is the correct solution because built-in roles cannot provide only the restart action without additional permissions. Custom roles allow precise definition of allowed actions, adhering to least privilege. The support engineers get exactly the permission needed and nothing more.
- ✗
Configure an Azure Policy definition that allows only the restart operation on virtual machines.
Why it's wrong here
Azure Policy is used to enforce rules on resource properties (e.g., requiring specific tags or allowed locations), not to grant permissions. Policies cannot be used to allow or deny actions for specific users; that is the function of Azure RBAC.
When this WOULD be correct
A company needs to ensure that all virtual machines in a subscription have a specific tag applied, and any VM without the tag must be automatically denied creation. In this case, an Azure Policy definition with a deny effect would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a custom role in Azure RBAC that includes only the 'Microsoft.Compute/virtualMachines/restart/action' permission and assign it to the support engineers.Correct answer▾
Why this is correct
Creating a custom role is the correct solution because built-in roles cannot provide only the restart action without additional permissions. Custom roles allow precise definition of allowed actions, adhering to least privilege. The support engineers get exactly the permission needed and nothing more.
✗Assign the support engineers the Virtual Machine Contributor built-in role.Wrong answer — click to see why▾
Why this is wrong here
The Virtual Machine Contributor role allows restarting VMs but also permits modifying VM configuration and deleting VMs, violating the principle of least privilege.
★ When this WOULD be the correct answer
If the requirement were to allow support engineers to restart VMs and also manage VM configurations (e.g., resize, update), but not delete VMs or access data, then Virtual Machine Contributor would be appropriate.
Why candidates choose this
Candidates may assume 'Contributor' is a limited role and overlook that it includes write and delete permissions beyond restart.
✗Assign the support engineers the Owner built-in role on the resource group containing the VMs.Wrong answer — click to see why▾
Why this is wrong here
The Owner role grants full access to all resources, including the ability to modify, delete, and access VM data, which violates the principle of least privilege and the specific restrictions required.
★ When this WOULD be the correct answer
If the question required granting full administrative control over the resource group and its resources, such as allowing a team to manage all aspects of VMs including configuration changes and deletions, then the Owner role would be appropriate.
Why candidates choose this
Candidates may mistakenly think that assigning a broad role at the resource group level is a quick solution, overlooking that Owner provides excessive permissions beyond the needed restart action.
✗Configure an Azure Policy definition that allows only the restart operation on virtual machines.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce compliance rules on resources, not to grant permissions. It cannot allow users to perform actions; it only prevents or audits actions. Therefore, it cannot be used to grant restart permissions.
★ When this WOULD be the correct answer
A company needs to ensure that all virtual machines in a subscription have a specific tag applied, and any VM without the tag must be automatically denied creation. In this case, an Azure Policy definition with a deny effect would be the correct solution.
Why candidates choose this
Candidates may confuse Azure Policy with Azure RBAC, thinking that policies can grant permissions, or they may believe that a policy can be used to allow specific operations while denying others.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure role
An Azure role is a set of permissions that defines what actions a user, group, or application can perform on specific Azure resources.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.