AZ104-Q: calculate effective Azure access
A user has Reader at a resource group and Contributor at its subscription. What Azure RBAC access do they normally have to a resource in that group, absent deny assignments?
- A) Reader only because the narrower scope wins.
- B) No access because roles conflict.
- C) Contributor because applicable RBAC role assignments are additive. ✓
- D) Owner because both roles combine into Owner. Answer: C. Azure RBAC allows from all applicable assignments add together; a narrower Reader does not cancel Contributor. Why not the others: Specificity is not an override rule, and these roles do not create Owner.