Explanation:

This scenario tests your knowledge of Azure Role-Based Access Control (RBAC) and the scope hierarchy in Azure (Management Group # Subscription # Resource Group # Resource).
* At the subscription level, User1 has the Reader role. This allows the user to view all resources within the subscription, but not access data stored inside those resources.
* At the RG1 level, User1 also has Reader and Data Access. This role is special - it grants both read access to resource configuration and data access to the underlying data plane (for example, the blobs in a storage account).
1# # User1 can read the data stored in storage1 # YES Since storage1 is inside RG1, and Reader and Data Access covers both resource and data access, User1 can read data stored in storage1 (e.g., list blobs, view content).
# Answer: YES
* At the subscription level, User2 has the Reader role (read-only, no create permissions).
* At the RG1 level, User2 has the Contributor role - this allows full management permissions on resources within RG1.
* The question asks about RG2, not RG1.
2# # User2 can create a virtual network in RG2 # YES However, RG2 does not have any explicit assignment for User2.
But since Contributor at the subscription level gives create/delete permission across all resources, and here User2's Contributor role is scoped to RG1 only, it does not extend to RG2.
So User2 cannot create resources in RG2 because Contributor permission doesn't propagate across resource groups unless assigned at a higher scope.
# Correct Answer: NO (User2 cannot create in RG2)
* The JSON data shows that User3 has the User Access Administrator role assigned directly on the storage1 resource. The User Access Administrator role allows managing role assignments (RBAC) at that specific scope - granting or removing access to others.
3# # User3 can assign roles for storage1 # YES Therefore, User3 can assign (and remove) RBAC roles for storage1.
# Answer: YES
* Microsoft Learn: Implement Role-Based Access Control (RBAC)
* Microsoft Learn: Understand scope inheritance in Azure RBAC
* Microsoft Learn: Manag e access using the User Access Administrator role
* Exam Ref SC-300: Manage access to Azure resources using roles and assignments Key References from Microsoft SC-300 Official Materials: