Question 20 - Microsoft Azure AZ-500 Real Exam Questions [Feb 2026 Update]

Q: 20

DRAG DROP You have an Azure subscription. You plan to create two custom roles named Role1 and Role2. The custom roles will be used to perform the following tasks:

• Members of Role1 will manage application security groups.

• Members of Role2 will manage Azure Bastion.

You need to add permissions to the custom roles. Which resource provider should you use for each role? To answer, drag the appropriate resource providers to the correct roles. Each resource provider may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

Microsoft.Compute
Microsoft.Network
Microsoft.Security
Microsoft.Solutions

Correct Answer:

Answer Area Role1:: B. Microsoft.Network Role2:: B. Microsoft.Network

Explanation

Both Application Security Groups (ASGs) and Azure Bastion are networking resources within Azure.

Role1 (Application Security Groups): ASGs are used to group virtual machines and define network security policies based on those groups. All management operations for ASGs, such as creating, deleting, or modifying them, are permissions within the Microsoft.Network resource provider. For example, the permission to create an ASG is Microsoft.Network/applicationSecurityGroups/write.
Role2 (Azure Bastion): Azure Bastion is a platform-managed service that provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal. Since Bastion is fundamentally a networking service that facilitates secure connections to resources within a virtual network, its management also falls under the Microsoft.Network resource provider. For instance, creating a Bastion host requires the Microsoft.Network/bastionHosts/write permission.

Therefore, Microsoft.Network is the correct resource provider for both custom roles.

References

Microsoft Official Documentation (Microsoft Learn): "Azure resource providers and types." This document lists the resource types managed by each resource provider. Under the Microsoft.Network provider, you can find applicationSecurityGroups and bastionHosts, confirming that both are managed by this provider.

Microsoft Official Documentation (Microsoft Learn): "Application security groups." In the Permissions section, it states that ASGs are a resource within Microsoft.Network. For example, the built-in Network Contributor role, which can manage ASGs, has its permissions defined under Microsoft.Network/*.

Microsoft Official Documentation (Microsoft Learn): "Working with a custom role." In the tutorial for creating custom roles, examples for networking resources consistently use the Microsoft.Network provider for permissions related to virtual networks, subnets, and associated services like Azure Bastion. The necessary actions for managing Bastion, such as Microsoft.Network/bastionHosts/read, clearly fall under this provider.

Therefore, Microsoft.Network is the correct resource provider for both custom roles.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE