Exam AZ-104 topic 2 question 85 discussion

To ensure that User1 can assign the Reader role for VNet1 to other users, you need to give User1 the necessary permissions at the appropriate scope. In this scenario, the user needs permissions specifically related to VNet1. Option C. Assigning User1 the Network Contributor role for VNet1 is the correct approach. This role grants the user permissions to manage Azure networking resources, including the ability to assign roles such as Reader to other users for the specific virtual network VNet1. So, the correct answer is: C. Assign User1 the Network Contributor role for VNet1.

Owner and User Access Administrator can assign roles

Three of the answers involve assigning a Contributor role. Contributor does not include the ability to assign rights, permissions, or roles. Therefore the correct answer has to be D, assign the User Access Admin role.

To allow User1 to assign the Reader role for VNet1 to other users, User1 needs to have permissions related to Azure RBAC (Role-Based Access Control). Among the listed options: A. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1. - The Contributor role allows a user to manage everything except access. B. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1. - Again, the Contributor role doesn't grant User1 the ability to assign roles to others. C. Assign User1 the Network Contributor role for VNet1. - This role provides permissions to manage networking resources, not role assignments. D. Assign User1 the User Access Administrator role for VNet1. - This role provides permissions to manage user access to Azure resources, which means User1 can assign roles to other users for VNet1. The correct action to meet the requirement is: D. Assign User1 the User Access Administrator role for VNet1.

Network Contributor - Lets you manage networks, but not access to them. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor User Access Administrator - Lets you manage user access to Azure resources. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator Only User Access Administrator or Owner could assign roles to other users.