Examkin

Question

Difficulty: EasyAzure Role Assignments and Scopes

For a new production deployment, an administrator configures the following Azure resource hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-AppStore`
- Resource Group: `RG-Services`
- App Service: `api-service-01`

A developer named DevUser1 is assigned the Reader role at the `Sub-AppStore` subscription level. DevUser1 is also assigned the Contributor role at the `RG-Services` resource group level.

Which of the following describes the effective permission of DevUser1 for `api-service-01`?

  1. A
    No permissions, because assigning different roles at different levels of the hierarchy creates a conflict.
  2. B
    Reader permissions, because the subscription-level assignment takes precedence and restricts permissions at lower scopes.
  3. Contributor permissions, because Azure RBAC roles are additive and the Contributor assignment at the resource group level applies.Answer
  4. D
    Contributor permissions, but only if DevUser1 also holds an administrator role in Microsoft Entra ID.

Answer

Contributor permissions, because Azure RBAC roles are additive and the Contributor assignment at the resource group level applies.
The correct answer states that DevUser1 has Contributor permissions because Azure RBAC is additive. When a user is assigned multiple roles at different scopes, the effective permission is the sum of those permissions, so the Contributor role at the resource group scope grants full write access to the App Service, overriding the inherited read-only access from the subscription level.

Step-by-Step Solution

1
Determine the user's role assignment at the highest level of the scope hierarchy.
DevUser1 is assigned the Reader role at the subscription level, which inherits down to the resource group and the App Service.
This establishes the baseline inherited permissions.
2
Determine the user's role assignment at the lower levels of the scope hierarchy.
DevUser1 is assigned the Contributor role at the resource group level, which applies to the resource group and the App Service.
This identifies any additional permissions granted closer to the resource.
3
Combine the permissions using the additive rule of Azure RBAC.
Reader (inherited) + Contributor (explicit) = Contributor permissions on the App Service.
Azure RBAC evaluates the union of all role assignments applicable to the resource.

Key Concept

Azure RBAC role assignments are additive, meaning a user's effective permissions at a given scope are the union of all roles assigned at that scope and any inherited parent scopes.
Estimated Time:1m 0s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic