Exam SC-100 topic 6 question 2 discussion

a custom role-based access control (RBAC) role - can be used to delegate access

Given answer is correct: B. a custom role-based access control (RBAC) role - can be used to delegate access

Answer: B https://www.youtube.com/watch?v=r-P-2lGzPFQ&list=PLQ2ktTy9rklhzzkSEZvDZT4QSIVUQZD-Y&index=9 SC-100 Question 107

B is the answer. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles If the Azure built-in roles don't meet the specific needs of your organization, you can create your own custom roles. Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.

The reason the RBAC is good it is because the other options do not offer the exact permission to manage the NSG, Firewall, Front door and etc. Therefore we would need a Custom role based access control.

In my opinion, I would assign the network role to the subscription or use management groups. Since there is only one subscription, I'd go with option A, management groups will add more complexity unless you want to use PIM. But since PIM is not mentioned A should be the correct answer.

I would go with “subscription” as the RBAC assignment would be made on the sub1 subscription. There doesn’t appear to be a need for a custom role. Network Contributor would be sufficient and appropriate given the requirements.