You have an Azure subscription that contains the custom roles shown in the following table.

In Azure RBAC, when creating a custom role through the Azure portal, you can only clone from existing roles of the same scope type. Since Role3 is an Azure subscription-level custom role, it can be cloned only from subscription-level roles—either built-in subscription roles (like Owner, Contributor, Reader) or other custom subscription roles.

Azure AD roles (directory roles) cannot be cloned to create subscription roles because they operate at a completely different control plane (Azure AD vs Azure Resource Manager).

Thus, from the given table:

Role1 = Azure AD role → cannot be cloned.

Role2 = Azure subscription role → can be cloned.

Therefore, the correct option is C