HOTSPOT -
You have an Azure subscription that contains the custom roles shown in the following table.
In the Azure portal, you plan to create new custom roles by cloning existing roles. The new roles will be configured as shown in the following table.
Which roles can you clone to create each new role? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-create https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal
Built-in AD roles can't be cloned, but built-in subscription roles can be. Custom roles of either type can be cloned.
Azure AD supports 2 types of roles definitions: Built-in roles Custom roles Built-in roles are out of box roles that have a fixed set of permissions. These role definitions cannot be modified. There are many built-in roles that Azure AD supports, and the list is growing. To round off the edges and meet your sophisticated requirements, Azure AD also supports custom roles. Granting permission using custom Azure AD roles is a two-step process that involves creating a custom role definition and then assigning it using a role assignment. A custom role definition is a collection of permissions that you add from a preset list. These permissions are the same permissions used in the built-in roles. REF: https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-overview
Any REF URL than we cannot clone Built-in AD Roles?
The purpose of cloning is to modify and customize the roles. Since a built-in role is out-of-the-box and cannot be modified, there is no point allowing user to clone it.
this explanation makes no sense since it would also apply to RBAC Resource roles
You can try it in the lab
Here you have : https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-overview
the answer is correct. test at the lab. you can clone only custome azure ad role or create from scratch.
Role3: Role1 only Role4: Role 2 and built in Azure Subscription role only
On exam 1/2/24
Correct answer. You can only clone Azure built in roles to create custom roles but you cant clone Azure AD roles.
on exam 20240715
Role1 and 2 are custom roles. why can't role1 be cloned?
in exam 08/12/23
For AzureAD new custom role only can be created from "Clone from a custom role" and "Start from scratch" so answer if can be cloned only from the existing custom role which "Role1" for this case.