An admin assigns 'Reader' at the subscription level and 'Contributor' on one resource group. What can the user do in that resource group?
A.Read only — the most restrictive assignment wins
RBAC has no 'most restrictive wins' — that's a firewall-ACL mental model.
B.Manage resources — the effective access is the union of both assignments
Assignments are additive; the broader grant applies in its scope. Correct.
C.Nothing — conflicting assignments cancel out
Assignments never cancel each other.
D.Manage resources only after re-authenticating
Role changes take effect within minutes; no special re-auth step is required.
Why this answer
Azure RBAC is additive: effective permissions are the UNION of all applicable role assignments (there is no deny in RBAC — denies require Azure Policy or explicit deny assignments). Reader at subscription + Contributor at the RG = Contributor capabilities in that RG.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Governance practice session.
Practice Identity & Governance