A platform engineer is mentoring a newly hired Azure administrator on how role-based access control works. The administrator asks what a role assignment is made of and how permissions travel across the hierarchy. Which statement should the engineer make?

1. A. Role definitions must be created individually for each user, so every user ends up with a custom role 💬 A
2. B. Access granted at a child scope is inherited upward by parent scopes, so a role assigned in a resource group also applies at the subscription level 💬 B
3. C. Every role assignment combines a security principal, a role definition, and a scope, and access granted at a parent scope is inherited by child scopes ✓ C
4. D. Role assignments are enforced at application sign-in, where they can challenge the user for a second factor 💬 D

Reveal answer

Correct answer: Every role assignment combines a security principal, a role definition, and a scope, and access granted at a parent scope is inherited by child scopes

Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview