Examkin

Question

Difficulty: Very hardManagement Groups Hierarchies

A multinational logistics company, GlobalRoute Logistics, organizes its Azure resources using a Management Group hierarchy structured as follows:

* Tenant Root Group
* Global-Root-MG
* Core-Services-MG
* Subscription: Core-Prod-Sub
* Resource Group: Prod-Shared-RG (has a `ReadOnly` Resource Lock applied)
* Subscription: Core-Shared-Sub
* Logistics-Operations-MG
* Subscription: Fleet-Ops-Sub
* Resource Group: Ops-Data-RG

The following configurations are applied across the hierarchy:

1. An Azure Policy definition is assigned at Global-Root-MG that restricts allowed resource types to `Microsoft.Storage/storageAccounts` and `Microsoft.Network/virtualNetworks` using the `Deny` effect. No exclusions are configured.
2. User1 is assigned the Contributor role at the Logistics-Operations-MG level, and the Reader role at the Fleet-Ops-Sub level.
3. User2 is assigned the Contributor role at the Core-Services-MG level.

Which two of the following statements are correct regarding the permissions, policy compliance, and resource locks within this management group hierarchy? Select two.

  1. User1 can successfully create a new Storage Account within the Ops-Data-RG resource group.Answer
  2. B
    User1 is prevented from creating any resources in the Ops-Data-RG resource group because the Reader role assigned at the subscription level restricts their inherited Contributor permissions.
  3. C
    User2 can successfully create a new Virtual Machine in the Core-Shared-Sub subscription because their Contributor role is assigned at a scope closer to the resource than the inherited Azure Policy.
  4. User2 is prevented from creating a Storage Account in the Prod-Shared-RG resource group because the ReadOnly resource lock applied at the resource group level is inherited and blocks all write operations.Answer

Answer

User1 can successfully create a new Storage Account within the Ops-Data-RG resource group, and User2 is prevented from creating a Storage Account in the Prod-Shared-RG resource group because the ReadOnly resource lock applied at the resource group level is inherited and blocks all write operations.
The correct statements are that User1 can successfully create a new Storage Account within the Ops-Data-RG resource group, and User2 is prevented from creating a Storage Account in the Prod-Shared-RG resource group because the ReadOnly resource lock applied at the resource group level is inherited and blocks all write operations. User1's Contributor permissions are inherited from the parent management group and are additive; they are not restricted by the Reader assignment at the subscription level, and creating a Storage Account complies with the policy. User2 cannot write to Prod-Shared-RG because the ReadOnly lock applied at the resource group level inherits to all resources and blocks write actions like resource creation.

Step-by-Step Solution

1
Analyze User1's permissions in the Ops-Data-RG resource group.
User1 has the Contributor role inherited from Logistics-Operations-MG. Even though User1 has the Reader role assigned at the Fleet-Ops-Sub level, Azure RBAC roles are additive, meaning the Reader role does not restrict the Contributor role permissions. Thus, User1 has Contributor permissions in Ops-Data-RG.
To determine the effective RBAC permissions of a user across a management group and subscription hierarchy.
2
Evaluate the Azure Policy effect on User1's and User2's deployment actions.
The Azure Policy at Global-Root-MG restricts allowed resource types to storage accounts and virtual networks. Because Ops-Data-RG is a descendant of Global-Root-MG, this policy applies. Creating a Storage Account is allowed by the policy, so User1's request succeeds. However, creating a Virtual Machine is denied, so User2's attempt to create a Virtual Machine in Core-Shared-Sub fails, overriding User2's Contributor permissions.
To verify if the proposed resource creation complies with the inherited Azure Policy definitions.
3
Evaluate the impact of the Resource Lock on User2's permissions in Prod-Shared-RG.
Prod-Shared-RG has a ReadOnly resource lock. This lock inherits to all resources and scopes within that resource group. It blocks all write operations, including creating a new Storage Account, even for a user with the Contributor role. Therefore, User2 cannot create a Storage Account in Prod-Shared-RG.
To assess how resource locks inherit and restrict administrative actions within resource groups.

Key Concept

Understanding Azure Management Group hierarchies, Azure RBAC inheritance, Azure Policy inheritance, and Resource Lock inheritance rules.
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic