Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Virtual Machine Contributor grants rights to create, start, stop, restart, and delete virtual machines and the resources required for them, but it does not permit managing role assignments. Because it is scoped to virtual-machine resources only, it satisfies the least-privilege requirement. Contributor would permit dev1 to manage every resource type in RG1, which is broader than necessary. Owner includes full access plus the ability to delegate permissions, violating the restriction on access management. User Access Administrator can manage role assignments but cannot perform VM operations. Therefore, Virtual Machine Contributor is the correct role.