AZ-900 Practice Question 37: RBAC Additive Permissions

Azure RBAC is an additive model: your effective permissions are the sum of your role assignments. Microsoft uses this precise pairing as its worked example: Contributor at the subscription plus Reader on a resource group sums to Contributor for the subscription, and the Reader assignment "has no impact". Role assignments also inherit downward through the parent-child scope hierarchy, so the subscription-level Contributor already reached the resource group before the second assignment existed.

Option B imports a most-specific-wins rule from Azure Policy that RBAC does not have. The only thing that overrides a granted permission is a deny assignment, which Resource Manager evaluates before role assignments, and there is none here. Option C has nothing to cancel: Reader adds no permission that Contributor does not already include. Option D is the trap for anyone who reads "full access" too quickly; Contributor grants full access to manage all resources but does not allow you to assign roles in Azure RBAC. Granting access to others requires Owner or User Access Administrator.

Reference: What is Azure role-based access control (Azure RBAC)?