Examkin

Question

Difficulty: MediumManagement Groups Hierarchies

Vanguard Renewable Systems manages its Azure environment using a Management Group (MG) hierarchy. The hierarchy and configuration are set up as follows:

* Tenant Root Group
* Retail-MG: An Azure Policy restricting virtual machine sizes to `Standard_D2s_v3` and `Standard_D4s_v3` is assigned here. User1 is assigned the Reader role.
* Online-MG: User2 is assigned the Contributor role.
* Online-Prod-Sub (Subscription)
* Web-RG (Resource Group): A `CanNotDelete` resource lock is applied to this resource group.
* Offline-MG
* Offline-Prod-Sub (Subscription)
* POS-RG (Resource Group): User1 is assigned the Owner role.

Which two statements are correct regarding the effective policies, permissions, and locks in this hierarchy?

  1. A virtual machine of size Standard_F4s_v2 cannot be deployed in the Web-RG resource group.Answer
  2. User2 cannot delete resources within the Web-RG resource group.Answer
  3. C
    User1 can only perform read actions in POS-RG because the Reader role inherited from Retail-MG overrides the Owner role assigned at the resource group level.
  4. D
    The VM size restriction policy does not apply to resources in Online-Prod-Sub because policies assigned at a management group level must be explicitly activated at the subscription level.

Answer

A virtual machine of size Standard_F4s_v2 cannot be deployed in the Web-RG resource group, and User2 cannot delete resources within the Web-RG resource group.
The correct statements are that the Standard_F4s_v2 virtual machine cannot be deployed because the policy restricting VM sizes is inherited from the parent Management Group, and that User2 cannot delete resources in the Web-RG resource group because the CanNotDelete lock is active and applies to all users regardless of their RBAC roles.

Step-by-Step Solution

1
Analyze Azure Policy inheritance down the Management Group hierarchy.
The VM size restriction policy is applied at the Retail-MG level. Since Online-Prod-Sub and Web-RG are descendants of Retail-MG, they inherit this policy, meaning only Standard_D2s_v3 and Standard_D4s_v3 VMs can be deployed.
Azure Policies apply to the scope at which they are assigned and are inherited by all child scopes down the management group and resource hierarchy.
2
Analyze the impact of the resource lock on Web-RG.
A CanNotDelete resource lock is applied to Web-RG. User2 has Contributor permissions, but the lock overrides RBAC delete permissions.
Resource locks apply to all users and roles, preventing the deletion of resources regardless of the user's RBAC role.
3
Evaluate the additive nature of Azure RBAC roles.
User1 has Reader at Retail-MG and Owner at POS-RG. User1's effective access in POS-RG is Owner because roles are cumulative (additive).
Azure RBAC does not support explicit 'deny' assignments via custom roles, and roles assigned at lower scopes do not get overridden by less privileged roles at higher scopes.

Key Concept

Azure Management Groups allow governance (Policies, RBAC, and Locks) to be applied at scale and inherited down the resource hierarchy.
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic