Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization's Azure environment has the following resource hierarchy:
- Management Group: `MG-Corporate`
- Subscription: `Sub-Dev`
- Resource Group: `RG-Shared`
- Resource Group: `RG-Secret`

A group of developers is currently assigned the Reader role at the `Sub-Dev` subscription scope. You must ensure that the developers can view resources in `RG-Shared`, but they must not be able to view any resources in `RG-Secret`.

Which configuration should you implement to meet this requirement while adhering to the principle of least privilege?

  1. Remove the Reader role assignment from the subscription level, and assign the Reader role to the developer group at the RG-Shared resource group scope.Answer
  2. B
    Keep the Reader role assignment at the subscription level, and assign a custom Azure RBAC role with a Deny action to the developer group at the RG-Secret resource group scope.
  3. C
    Keep the Reader role assignment at the subscription level, and assign the Reader role to the developer group at the RG-Shared resource group scope while omitting the assignment at the RG-Secret scope.
  4. D
    Remove the Reader role assignment from the subscription level, and assign the Global Reader directory role in Microsoft Entra ID to the developer group.

Answer

Remove the Reader role assignment from the subscription level, and assign the Reader role to the developer group at the RG-Shared resource group scope.
Removing the subscription-level Reader assignment prevents developers from inheriting read access to RG-Secret. Assigning the Reader role directly at the RG-Shared scope restricts their access to only the necessary resource group, fulfilling the security requirement without over-provisioning.

Step-by-Step Solution

1
Analyze the impact of the current subscription-level assignment.
The Reader assignment at the subscription level is inherited by all descendant scopes, meaning the developer group currently has read access to both RG-Shared and RG-Secret.
Azure RBAC roles are additive and inherit down the resource hierarchy.
2
Evaluate restrictiveness options in standard Azure RBAC.
Standard Azure RBAC does not support manual Deny assignments to block inherited permissions.
Since inherited permissions cannot be blocked at a lower scope, the broad parent assignment must be removed to secure RG-Secret.
3
Re-assign permissions at the target resource group scope.
Remove the role from the subscription and assign the Reader role directly to the developer group at the RG-Shared scope.
This configuration provides the required access to RG-Shared while preventing any access to RG-Secret, adhering to the principle of least privilege.

Key Concept

Azure RBAC inheritance and scope hierarchy
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic