Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

A company's Azure environment contains the following resource hierarchy:
- Management Group: `MG-Finance`
- Subscription: `Sub-Treasury`
- Resource Group: `rg-vault`

A security principal named `AppService-SP` is assigned the Reader role at the `MG-Finance` management group level. An administrator also assigns the Contributor role to `AppService-SP` at the `rg-vault` resource group level.
A developer needs to determine the effective permissions of `AppService-SP` for a key vault named `kv-secrets` located inside `rg-vault`.
Which permissions does `AppService-SP` have for `kv-secrets`?

  1. Contributor permissions, because Azure RBAC role assignments are additive and the most permissive role applies.Answer
  2. B
    Reader permissions only, because the Reader assignment at the management group level takes precedence.
  3. C
    Contributor permissions only, because role assignments at a lower scope override assignments at a higher scope.
  4. D
    No permissions, because conflicting role assignments at different scopes result in access being denied.

Answer

Contributor permissions, because Azure RBAC role assignments are additive and the most permissive role applies.
The correct answer is correct because Azure RBAC role assignments are additive. A security principal's effective permissions are the sum of all roles assigned at the current scope and any inherited parent scopes. In this scenario, the Contributor role assigned at the resource group scope provides broader access than the Reader role inherited from the management group, granting Contributor-level permissions on the key vault.

Step-by-Step Solution

1
Analyze the role assignments and their respective scopes in the resource hierarchy.
Identify that the Reader role is assigned at the Management Group scope and the Contributor role is assigned at the Resource Group scope.
To evaluate how permissions propagate down the resource hierarchy.
2
Determine how permissions inherit down to the child resource.
The key vault (`kv-secrets`) inherits the Reader role from the Management Group and the Contributor role from the Resource Group.
To map all active role assignments applying to the target resource.
3
Apply the Azure RBAC additive permission model to calculate the effective permissions.
The security principal receives the combined permissions of both roles, where the broader Contributor role includes all operations, resulting in effective Contributor access.
Azure RBAC roles do not override or block each other; they accumulate to form the effective permissions.

Key Concept

Azure RBAC inheritance and additive permission model
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic