An admin assigns a user the 'Virtual Machine Contributor' role on a resource group. What does Azure RBAC determine?
A.Whether the user can sign in
Sign-in is authentication handled by Entra ID — RBAC is the authorization layer after sign-in.
B.What actions the user can perform on resources within that scope
Role + principal + scope = what actions are allowed. Correct.
C.Which region the user's resources must be deployed to
Region restrictions are Azure Policy's job, not RBAC.
D.The user's network bandwidth allocation
RBAC has nothing to do with bandwidth.
Why this answer
RBAC is Azure's authorization system: a role assignment = security principal + role definition + scope (management group, subscription, resource group, or resource). Access is allow-based and inherits downward — grant at a broader scope applies to all child resources.
Correct answer: B · Last reviewed 2026-02-13
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Access practice session.
Practice Identity & Access