AZ-104 Practice Test 1

A user in your Microsoft Entra tenant is assigned the Reader role at the scope of subscription Sub1. Later, you assign the same user the Contributor role at the scope of the resource group RG-Finance, which lives in Sub1.

The user reports that they still cannot create a storage account in RG-Finance and believes the Reader assignment is blocking them. Assuming no deny assignments and no resource locks exist, what are the user's effective permissions on RG-Finance?