Examkin

Question

Difficulty: MediumManagement Groups Hierarchies

NovaSpace Aerospace uses Azure Management Groups to govern its subscription environment. The hierarchy and access controls are configured as follows:

* Tenant Root Group
* Engineering MG
* Aviation-Prod Subscription
* RG-Aviation (Resource Group)
* Space-Prod Subscription
* Research MG
* R&D-Test Subscription

The environment has the following configurations:
* User1 is assigned the Reader role at the Tenant Root Group.
* User2 is assigned the Contributor role at the Engineering MG.
* An Azure Policy definition that restricts allowed virtual machine SKUs is assigned at the Engineering MG.
* A CanNotDelete resource lock is applied to the RG-Aviation resource group.

An administrator moves the Aviation-Prod Subscription from the Engineering MG to the Research MG.

Which two statements describe the results of this administrative action?

  1. User2 no longer has the Contributor role for resources in the Aviation-Prod Subscription.Answer
  2. The virtual machine SKU restriction policy assigned at the Engineering MG stops applying to the Aviation-Prod Subscription.Answer
  3. C
    User1 loses the Reader role for resources in the Aviation-Prod Subscription.
  4. D
    The CanNotDelete resource lock on the RG-Aviation resource group is automatically removed.
  5. E
    The virtual machine SKU restriction policy continues to block non-compliant virtual machines in the Aviation-Prod Subscription.

Answer

The correct answers state that User2 no longer has the Contributor role for resources in the Aviation-Prod Subscription, and the virtual machine SKU restriction policy assigned at the Engineering MG stops applying to the Aviation-Prod Subscription.
When a subscription is moved between management groups, it inherits the policy and access control (RBAC) designs of its new parent management group and loses those of its former parent. Since User2's Contributor permission and the virtual machine SKU restriction policy were inherited from the Engineering Management Group, moving the subscription to the Research Management Group removes both. Direct configurations on the subscription or its child resources (such as resource locks on resource groups) and inheritance from higher levels that remain in the hierarchy path (like the Tenant Root Group) are unaffected.

Step-by-Step Solution

1
Determine the impact of the subscription move on inherited RBAC roles.
User1's role is inherited from the Tenant Root Group, which remains a parent, so it persists. User2's role is inherited from the Engineering MG, which is no longer a parent, so it is removed.
To identify which permissions are lost or retained based on management group scope boundaries.
2
Determine the impact of the subscription move on inherited Azure Policy assignments.
The policy restricting virtual machine SKUs was assigned at the Engineering MG. Since the subscription is moved to the Research MG, it stops inheriting the policy.
To determine which policies apply dynamically at the subscription's new location in the hierarchy.
3
Determine the impact of the subscription move on resource locks inside the subscription.
The CanNotDelete lock is applied directly to the RG-Aviation resource group and is not inherited from a management group, so it remains intact.
To verify whether resources inside the subscription maintain their local settings after a parent migration.

Key Concept

Azure Management Groups hierarchy governs policy and RBAC inheritance; moving a subscription changes its inherited configurations but preserves direct resources configurations such as resource locks.
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic