Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

The IT infrastructure of your company is organized under the following Azure resource structure:

- Tenant Root Group (Management Group)
- MG-Production (Management Group)
- Sub-Analytics (Subscription)
- RG-DataStore (Resource Group)
- storagedata1 (Storage Account)

You need to grant access to a user named Liam. Liam must be able to perform the following tasks:
1. Read blob data inside the containers of storagedata1.
2. Configure diagnostic settings on storagedata1 to stream resource logs to a Log Analytics workspace.

The solution must follow the principle of least privilege.

Which two roles should you assign to Liam?

  1. Storage Blob Data Reader assigned at the storagedata1 scopeAnswer
  2. Monitoring Contributor assigned at the storagedata1 scopeAnswer
  3. C
    Storage Account Contributor assigned at the RG-DataStore scope
  4. D
    Security Administrator assigned at the Sub-Analytics scope

Answer

Storage Blob Data Reader assigned at the storagedata1 scope and Monitoring Contributor assigned at the storagedata1 scope
To satisfy the requirements with least privilege, two distinct roles must be assigned at the storage account level. Reading blob data requires a data-plane role, and Storage Blob Data Reader is the least privileged role for this. Configuring diagnostic settings requires writing to the diagnostic settings path, which is a control-plane action covered by the Monitoring Contributor role. Assigning both roles at the storagedata1 scope ensures the user has exactly the permissions needed without access to other resources.

Step-by-Step Solution

1
Identify the role needed to read blob data.
Storage Blob Data Reader is the least privileged built-in role that allows reading blob data using Microsoft Entra ID authorization.
Control-plane roles like Contributor or Storage Account Contributor do not automatically grant data-plane access to blobs.
2
Identify the role needed to write diagnostic settings.
Monitoring Contributor is the least privileged built-in role that grants the 'Microsoft.Insights/DiagnosticSettings/Write' permission.
Reader permissions are insufficient to create diagnostic settings, while full Contributor or Owner roles would grant excessive administrative rights.
3
Determine the appropriate scope for role assignments.
Assign both roles at the specific storage account (storagedata1) scope.
Assigning roles at the storage account level instead of the resource group or subscription level aligns with the principle of least privilege.

Key Concept

Azure RBAC separates control-plane management (such as configuring monitoring) from data-plane access (such as reading blobs). A combination of specific built-in roles assigned at the narrowest possible scope is required to meet the requirements under least privilege.
Estimated Time:2m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic