Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization's Azure environment is structured with the following resource hierarchy:
- Tenant Root Group (Management Group)
- Corp-MG (Management Group)
- Corp-Sub (Subscription)
- Dev-RG (Resource Group)
- VM1 (Virtual Machine)
- Storage1 (Storage Account)

You need to assign Azure Role-Based Access Control (RBAC) roles to a developer named User1 at the Dev-RG scope. User1 must be able to start, stop, and restart VM1, and view the configuration settings of Storage1. User1 must not be able to delete or modify any other resources in the resource group.

Which two built-in Azure RBAC roles should you assign to User1 to meet the requirements while adhering to the principle of least privilege? Select two.

  1. Virtual Machine ContributorAnswer
  2. ReaderAnswer
  3. C
    Contributor
  4. D
    Global Administrator

Answer

Assign the Virtual Machine Contributor role and the Reader role to the developer.
To meet the requirements, the user must be assigned the Virtual Machine Contributor role, which allows managing virtual machine power states (start, stop, restart), and the Reader role, which allows viewing resource configurations (such as the storage account) without making any modifications. Together, these roles grant the exact permissions needed without exceeding the scope of the developer's tasks.

Step-by-Step Solution

1
Analyze the virtual machine requirement.
The developer needs to start, stop, and restart VM1. The Virtual Machine Contributor role grants full management of virtual machines without granting access to the virtual network or storage account they are connected to.
This satisfies the VM management requirement with least privilege.
2
Analyze the storage account configuration viewing requirement.
The developer needs to view the configuration of Storage1 but not modify it. The Reader role allows viewing all resources within the resource group (including Storage1) without granting write permissions.
This satisfies the viewing requirement with least privilege.
3
Combine the assignments and evaluate alternatives.
Assigning both Virtual Machine Contributor and Reader roles at the Dev-RG scope meets the objectives. Other roles like Contributor or Global Administrator grant excessive permissions.
Ensures adherence to the principle of least privilege.

Key Concept

Azure Role-Based Access Control (RBAC) Built-in Roles and Least Privilege
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic