Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization's Azure environment is structured with the following resource hierarchy:

* Management Group: Tenant-Root-MG
* Subscription: Sub-Prod-App
* Resource Group: RG-Web-Services

You need to grant a security group named Web-Operators the permission to restart and start virtual machines within the RG-Web-Services resource group. The operators must be able to view the virtual machines in the Azure portal but must not be permitted to create, delete, or modify the virtual machines or any other resources in the subscription.

Which of the following configurations should you implement to meet this requirement while adhering to the principle of least privilege?

  1. A
    Assign the built-in Contributor Azure RBAC role to the Web-Operators group at the RG-Web-Services resource group level.
  2. B
    Assign the Microsoft Entra ID directory role named Cloud Device Administrator to the Web-Operators group at the Tenant-Root-MG management group level.
  3. Create a custom Azure RBAC role with the Microsoft.Compute/virtualMachines/read, Microsoft.Compute/virtualMachines/start/action, and Microsoft.Compute/virtualMachines/restart/action permissions. Set the assignable scope to the RG-Web-Services resource group, and assign the role to the Web-Operators group at the resource group level.Answer
  4. D
    Assign the built-in Virtual Machine Contributor Azure RBAC role to the Web-Operators group at the Sub-Prod-App subscription level.

Answer

Create a custom Azure RBAC role with the read, start, and restart actions, set its assignable scope to the resource group, and assign it to the security group at the resource group level.
The correct approach involves creating a custom Azure RBAC role containing only the necessary permissions (read, start, and restart actions) and assigning it at the resource group level. This ensures that the security group members can only perform the specified actions on virtual machines within the target resource group and nowhere else, fully satisfying the principle of least privilege.

Step-by-Step Solution

1
Determine the minimum permissions required for the operational tasks.
Identify that viewing requires Microsoft.Compute/virtualMachines/read, while starting and restarting require Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/restart/action.
By defining only these specific actions, you avoid granting generic write or delete privileges.
2
Determine the correct scope for the role assignment.
Select the RG-Web-Services resource group as the target scope for assignment.
Assigning at the resource group level prevents the permissions from being inherited across the entire subscription, satisfying the least privilege principle.
3
Define the custom role properties and complete the assignment.
Configure a custom role with the identified actions, set the assignable scope to the resource group, and assign it to the Web-Operators security group.
This implements the custom RBAC role with the precise permissions and scope required.

Key Concept

Enforcing the principle of least privilege using custom Azure RBAC roles at the resource group scope.
Estimated Time:1m 30s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic