Exam AZ-104 topic 2 question 16 discussion

agree, its B

Option B is the correct answer. The User Access Administrator role allows users to manage user access to Azure resources, but it does not provide the ability to assign roles to other users. The Network Contributor role grants users the ability to manage networks, but it also does not provide the ability to assign roles to other users. The Security Admin and Security Reader roles are not relevant to the task at hand. Therefore, the correct option is to assign User1 the User Access Administrator role for VNet1, which will allow them to assign the Reader role to other users for that specific virtual network.

The correct answer is: B. Assign User1 the User Access Administrator role for VNet1. Why not others? A. Remove User1 from the Security Reader and Reader roles for Subscription1. This option doesn’t grant any new permissions to assign roles, so it does not meet the requirement. C. Assign User1 the Network Contributor role for VNet1. Network Contributor lets you configure VNet1 but not delegate access. D. Assign User1 the Network Contributor role for RG1. Role assignment requires the User Access Administrator role or Owner role.

B is corerct

Any variations of Contributor role does not allow to grant roles to other users. Contributor can be understood as resource read/write permission. To assing roles to other users you need some variation of Owner to repurce or Administrator role. Roles do not exclude each other, so if you have Read and Contributor role, you're still a Contributor and gain nothing by removing Reader role.

B. User Access Administrator do the following. Manage user access to Azure resources Assign roles in Azure RBAC Assign themselves or others the Owner role

"Lets you manage user access to Azure resources." https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles Lets you manage user access to Azure resources.

Right answer is B. Contributor = Can't grant access to others User Access Administration = Manage user access to Azure resources

This is a tricky question since it uses an Azure RBAC role Network Contributor as a possible answer. The question is for Azure Active Directory which does not have a Network Contributor built-in role. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

To allow User1 to assign the Reader role for VNet1 to other users, you can assign the Network Contributor role for VNet1 to User1. The Network Contributor role provides the permissions required to manage virtual networks, including the ability to assign the Reader role. Option C is correct. Option A is not correct because removing User1 from the Security Reader and Reader roles for Subscription1 does not provide the required permission for managing VNet1. Option B is not correct because the User Access Administrator role does not provide the permission to assign the Reader role for VNet1 to other users. Option D is not correct because assigning the Network Contributor role for RG1 only provides permission to manage resources in the resource group, but does not specifically provide permission to manage VNet1.

B is the answer. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator User Access Administrator - Lets you manage user access to Azure resources

Access aministrator

User administrator role

Hope, Contributor role could not able to assign access role hence B is right answer as User Access Admin role to assign access to others

B) " Assign User1 the User Access Administrator role for VNet1." User Access Administrator - "Lets you manage user access to Azure resources. " https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator

Correct Answer: B