Examkin

Question

Difficulty: HardManagement Groups Hierarchies

An enterprise retail company, Contoso Sports, organizes its Azure environment using the following Management Group (MG) hierarchy:

- Tenant Root Group
- MG-Retail-Global
- MG-Retail-APAC
- Sub-APAC-Online (Subscription)
- Sub-APAC-Backoffice (Subscription)
- MG-Retail-EMEA
- Sub-EMEA-Online (Subscription)

The following security controls and configurations are applied:
1. At MG-Retail-Global, an Azure Policy definition is assigned that denies the creation of public IP addresses (Microsoft.Network/publicIPAddresses).
2. At MG-Retail-APAC, the Owner role is assigned to User1.
3. At Sub-APAC-Online, a ReadOnly resource lock is applied to a resource group named 'rg-ecom-prod'.

User1 attempts to perform the following three tasks:
- Task A: Create a Virtual Network inside the 'rg-ecom-prod' resource group in the Sub-APAC-Online subscription.
- Task B: Create a Virtual Network inside a new resource group in the Sub-APAC-Backoffice subscription.
- Task C: Create a Public IP address in a new resource group in the Sub-APAC-Backoffice subscription.

Which of the tasks can User1 successfully complete?

  1. A
    Task A and Task B only
  2. Task B onlyAnswer
  3. C
    Task B and Task C only
  4. D
    None of the tasks

Answer

Only Task B (creating a Virtual Network inside a new resource group in Sub-APAC-Backoffice) can be successfully completed.
The correct option is the one stating that only Task B can be successfully completed. User1 inherits the Owner role at the MG-Retail-APAC level, which gives them full control over all subscriptions beneath it, including Sub-APAC-Online and Sub-APAC-Backoffice. In Sub-APAC-Backoffice, User1 can create a new resource group and deploy a Virtual Network, as there are no locks or policy restrictions preventing this action. Task A is blocked because the resource group has a ReadOnly lock, which prevents any configuration changes, including creating child resources like a Virtual Network. Task C is blocked because the policy denying public IP address creation is assigned at the higher MG-Retail-Global level, and policy assignments inherit down the management group hierarchy to all child subscriptions, overriding User1's local Owner permissions.

Step-by-Step Solution

1
Determine User1's effective permissions across the hierarchy.
User1 inherits the Owner role on Sub-APAC-Online and Sub-APAC-Backoffice.
Azure RBAC role assignments inherit down the management group hierarchy to all child subscriptions and resource groups.
2
Evaluate the impact of the resource lock on Task A.
Task A is blocked by the ReadOnly lock on 'rg-ecom-prod'.
A ReadOnly lock at the resource group level prevents creating new child resources, such as a Virtual Network, inside that resource group.
3
Evaluate the impact of the Azure Policy on Task C.
Task C is blocked by the Azure Policy denying public IP addresses.
Azure Policy assignments inherit down the hierarchy. Even with Owner permissions, the resource deployment fails because the policy denies public IP resource creation.
4
Evaluate Task B under the effective permissions and controls.
Task B succeeds since User1 has Owner access, and no policies or locks block the creation of a resource group or Virtual Network (without public IPs) in Sub-APAC-Backoffice.
The write action is authorized by RBAC and is not restricted by any policies or locks at or above this scope.

Key Concept

Azure Management Groups govern access, policy, and compliance across multiple subscriptions through hierarchical inheritance.
Estimated Time:2m 30s
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic