Which TWO statements about Azure RBAC evaluation are correct?

1. ✓ A Allow assignments are additive and inherited down the scope hierarchy (correct answer)
2. ✓ B A deny assignment takes precedence over any allow assignment (correct answer)
3. C Removing a role assignment instantly invalidates already-issued access tokens
4. D Assignments at a child scope override and replace those at a parent scope
5. E Data-plane access is granted by management-plane roles such as Contributor

Shortcut: Effective permissions are the union of every applicable allow assignment inherited from management group down to resource, and deny assignments override them. Tokens remain valid until expiry, so revocation is not instantaneous, and data-plane access needs explicit data roles.