In Azure RBAC, when creating a custom role through the Azure portal, you can only clone from existing roles of the same scope type. Since Role3 is an Azure subscription-level custom role, it can be cloned only from subscription-level roles-either built-in subscription roles (like Owner, Contributor, Reader) or other custom subscription roles.
Azure AD roles (directory roles) cannot be cloned to create subscription roles because they operate at a completely different control plane (Azure AD vs Azure Resource Manager).
Thus, from the given table:
* Role1 = Azure AD role # cannot be cloned.
* Role2 = Azure subscription role # can be cloned.
Therefore, the correct option is C