Examkin

Question

Difficulty: Very hardAzure Role Assignments and Scopes

Your company has an Azure environment structured with the following resource hierarchy:
* Management Group: `MG-Finance`
* Subscription: `Sub-Finance-Prod`
* Resource Group: `RG-Treasury`
* Storage Account: `sttreasurydata`
* Key Vault: `kv-treasury-keys`

You configure the following security settings:
1. A user named `User1` is assigned only the Microsoft Entra ID Global Administrator directory role.
2. A user named `User2` is assigned the Contributor role at the `MG-Finance` scope.
3. A user named `User3` is assigned the Reader role at the `Sub-Finance-Prod` scope and the Storage Blob Data Owner role at the `sttreasurydata` scope.
4. A user named `User4` is assigned the User Access Administrator role at the `RG-Treasury` scope.

Which of the following statements correctly describe the permissions and access levels of these users? (Select two.)

  1. User3 can upload blobs to the containers in sttreasurydata and list the properties of all resources inside RG-Treasury.Answer
  2. B
    User1 can immediately create and manage resources inside RG-Treasury because the Microsoft Entra ID Global Administrator role automatically inherits Owner permissions over all child subscriptions.
  3. C
    User2 can be prevented from deleting resources in RG-Treasury by applying a standard Azure RBAC Deny assignment at the resource group level, overriding the inherited Contributor role.
  4. User4 can assign the Contributor role to other users for resources inside RG-Treasury, but cannot create or modify resources within RG-Treasury themselves.Answer

Answer

The statements stating that User3 can upload blobs to sttreasurydata and list resource properties in RG-Treasury, and that User4 can assign Azure RBAC roles at the RG-Treasury scope but cannot create resources themselves, are correct.
The correct options accurately identify the additive and scoped nature of Azure RBAC. The option stating that User3 can upload blobs and list resource properties is correct because the Reader role at the subscription scope inherits down to allow control-plane viewing, while the Storage Blob Data Owner role at the storage account scope provides the required data-plane access. The option stating that User4 can assign roles but cannot create resources is correct because the User Access Administrator role is dedicated to security assignments and does not inherit resource creation privileges.

Step-by-Step Solution

1
Analyze the Microsoft Entra ID Global Administrator role for User1
Confirm User1 has no immediate access to Sub-Finance-Prod
Microsoft Entra ID directory roles do not automatically inherit permissions to manage Azure resource scopes. This separation prevents directory administrators from managing subscription resources without explicit access elevation.
2
Evaluate the possibility of denying inherited permissions for User2
Confirm that an administrator cannot create a standard Deny assignment
Azure RBAC is strictly additive; custom Deny assignments cannot be created by administrators to restrict permissions inherited from higher scopes.
3
Determine User3's control plane and data plane access
Verify that User3 can list resources and upload blobs
The Reader role at the subscription level provides control-plane read access, and the Storage Blob Data Owner role at the storage account level provides data-plane write access.
4
Examine User4's User Access Administrator permissions
Confirm User4 can manage role assignments but cannot modify resources
The User Access Administrator role is designed exclusively for configuring security permissions and lacks resource modification permissions.

Key Concept

Azure RBAC scope inheritance, control plane versus data plane authorization, the additive-only nature of standard RBAC, and the separation between Microsoft Entra ID directory roles and Azure resource roles.
Estimated Time:3m 0s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic