Exam AZ-400 topic 7 question 20 discussion

Answer is correct. There is no reference for shared querires. so its Contributor

Answer should be A. Reader

Answer should be D

https://learn.microsoft.com/en-us/azure/devops/boards/queries/set-query-permissions?view=azure-devops

D. Contributor https://learn.microsoft.com/en-us/azure/devops/boards/queries/set-query-permissions?view=azure-devops

Since the question asks for creating queries, it has to be Contributor. If only running query was needed, then Reader access would have been sufficient.

I think report is the keyword. Hard to report on a query that you can't share so it should be contributor.

A Reader can save his/her own queries. Since the question doesn't mention the word "Shared". As per least privilege, Reader is the right answer.

answer is D

View and run => Reader Create My queries => Contributor Create Shared queries => Project Admin Question does not refer to shared queries => Contributor

"Create" queries - Contributor.. Reader role can not create query

D Contributor. https://learn.microsoft.com/en-us/azure/devops/boards/queries/set-query-permissions?view=azure-devops#default-query-permissions

GTP: To ensure that a project manager can create custom work item queries to report on the project's progress using the principle of least privilege, you should add the project manager to the Project Administrators security group. The Project Administrators group is a built-in group in Azure DevOps that has permissions to perform administrative tasks on a project, such as creating and modifying work item types, managing team members and their permissions, and creating and modifying queries. By adding the project manager to this group, they will have the necessary permissions to create custom work item queries without giving them unnecessary privileges. On the other hand, adding the project manager to the Reader group would not provide them with the necessary permissions to create custom work item queries, while adding them to the Project Collection Administrators group or Contributor group would give them more privileges than necessary, which goes against the principle of least privilege. Therefore, the correct answer is C. Project Administrators.

A. Reader is Correct. The correct security group to add the project manager to is "Reader". This group provides the minimum necessary permissions for the project manager to create custom work item queries and view project information, while following the principle of least privilege. "Reader" provides the ability to view project information and run saved queries, but does not provide the ability to make changes to the project or its artifacts.

Answer: Contributor "All users, except those users assigned to the Readers group, can create and edit their own queries and save them under My Queries. Only the signed in user can view queries saved under their My Queries space." https://learn.microsoft.com/en-us/azure/devops/boards/queries/set-query-permissions?view=azure-devops

His role is called project admin guys. Reader will help him create his own queries but not to share it.

The answer is D, as a reader, you can only run queries, not create them.