Examkin

Question

Difficulty: HardAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization has the following Azure resource hierarchy:
* Tenant Root Group (Management Group)
* MG-Platform (Management Group)
* Sub-Connectivity (Subscription)
* RG-HubNet (Resource Group)
* MG-Apps (Management Group)
* Sub-App01 (Subscription)
* RG-AppLogic (Resource Group)
* RG-AppData (Resource Group)

You have a security group named DatabaseOps-SG. The members of this group must be able to perform the following tasks:
* Manage Azure SQL servers and databases within RG-AppData.
* Read and write database backup blobs directly in a storage account located in RG-AppData.
* View virtual networks and subnet configurations within RG-HubNet to assist with database private endpoint configuration.

The solution must follow the principle of least privilege.

Which three role assignments should you configure? (Select three).

  1. Assign SQL Server Contributor to DatabaseOps-SG at the RG-AppData scopeAnswer
  2. Assign Storage Blob Data Contributor to DatabaseOps-SG at the RG-AppData scopeAnswer
  3. Assign Reader to DatabaseOps-SG at the RG-HubNet scopeAnswer
  4. D
    Assign Contributor to DatabaseOps-SG at the Sub-App01 scope
  5. E
    Assign Application Administrator in Microsoft Entra ID to DatabaseOps-SG
  6. F
    Assign Owner to DatabaseOps-SG at the Tenant Root Group scope, and configure a Deny assignment at the Sub-App01 scope

Answer

Assign SQL Server Contributor at the RG-AppData scope, Storage Blob Data Contributor at the RG-AppData scope, and Reader at the RG-HubNet scope.
The correct role assignments are SQL Server Contributor at the RG-AppData scope, Storage Blob Data Contributor at the RG-AppData scope, and Reader at the RG-HubNet scope. The SQL Server Contributor role allows managing SQL servers and databases within the specific resource group without subscription-wide access. The Storage Blob Data Contributor role is required because standard control-plane roles (such as Contributor) do not grant permissions to read and write blobs directly. Assigning the Reader role at the RG-HubNet scope allows viewing the network infrastructure required to set up private endpoints without granting permissions to modify the network.

Step-by-Step Solution

1
Identify the required control plane roles for SQL Database management.
SQL Server Contributor at the RG-AppData scope.
This role allows database and server management at the minimum required resource group scope.
2
Identify the required data plane roles for Blob Storage access.
Storage Blob Data Contributor at the RG-AppData scope.
Control plane roles do not grant access to Blob data, so a data plane role is required.
3
Identify the required permissions for viewing network configurations.
Reader at the RG-HubNet scope.
This permits viewing the virtual network configurations in the connectivity subscription without modify permissions.

Key Concept

Azure RBAC utilizes separate roles for control plane and data plane operations and enforces scope inheritance down the resource hierarchy.
Estimated Time:2m 30s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic