A role is assigned Reader at the subscription and Contributor at the resource group. What are the effective permissions on a resource in that group?
- A Reader only
- B Contributor, because RBAC allow permissions are additive and inherited (correct answer)
- C Access denied
- D Owner
Shortcut: Azure RBAC allow assignments accumulate across inherited scopes. The union grants Contributor on resources within that group, while Reader still applies elsewhere in the subscription.