Exercise 2: What a Resource-Group-Level Role Grants to a New Resource — Possible Solution
====================================================================

Azure RBAC role assignments apply at a real, nested scope, and lower
levels of that scope automatically INHERIT permissions granted at a
higher level -- Management Group down through Subscription, Resource
Group, and finally individual Resource.

A Contributor role assigned at the Resource Group level sits one
level above individual resources in this real hierarchy. Because
inheritance flows downward automatically, ANY resource created inside
that Resource Group -- including one created after the role
assignment was made -- automatically falls under that same
inherited Contributor access, with no separate, additional role
assignment needed for the new resource specifically.

ANSWER: The Contributor role's own real permissions (full access to
manage resources, but not to grant access to others) automatically
extend to the new resource the moment it's created inside that
Resource Group, purely because of RBAC's own downward inheritance --
no new role assignment is required at the individual resource level
for this access to already apply.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly applies the chapter's own specific inheritance rule
(a role granted at a higher scope automatically applies to everything
inside it, "unless overridden more narrowly") to a concrete scenario
involving a resource that didn't even exist yet when the role was
assigned, showing the inheritance is genuinely automatic and ongoing,
not a one-time snapshot.