Examkin

Question

Difficulty: MediumManagement Groups Hierarchies

Veridian Manufacturing manages its Azure resources using the following Management Group (MG) hierarchy:

* Tenant Root Group (Policy assigned: Audit public IP addresses)
* Infrastructure-MG (User1 assigned Reader role)
* Security-MG
* Subscription-A
* Core-Services-MG
* Operations-MG
* Subscription-B

An administrator relocates Subscription-A from Security-MG to Operations-MG.

What is the status of User1's RBAC role assignment and the audit policy for resources inside Subscription-A after the move?

  1. User1 loses the Reader role for Subscription-A, and the audit policy remains active.Answer
  2. B
    User1 retains the Reader role for Subscription-A, and the audit policy remains active.
  3. C
    User1 loses the Reader role for Subscription-A, and the audit policy is no longer active.
  4. D
    User1 retains the Reader role for Subscription-A, and the audit policy is no longer active.

Answer

User1 loses the Reader role for Subscription-A, and the audit policy remains active.
The correct answer is that User1 loses the Reader role for Subscription-A, and the audit policy remains active. In Azure, both RBAC role assignments and Azure Policies inherit down the management group hierarchy. When Subscription-A is relocated, any inherited RBAC permissions originating from Infrastructure-MG are lost because the subscription's new path (Tenant Root Group -> Core-Services-MG -> Operations-MG) no longer includes Infrastructure-MG. However, since the audit policy is assigned at the Tenant Root Group, which remains the root ancestor of the subscription, the policy continues to inherit and apply to resources inside Subscription-A.

Step-by-Step Solution

1
Determine the impact of the relocation on inherited RBAC assignments.
User1 loses the inherited Reader role for Subscription-A.
The Reader role was assigned at Infrastructure-MG. When Subscription-A is moved to Operations-MG (which is under Core-Services-MG), it is no longer a descendant of Infrastructure-MG, breaking the inheritance path for that role assignment.
2
Determine the impact of the relocation on policies assigned at the Tenant Root Group level.
The public IP audit policy remains active.
The Tenant Root Group is the ultimate parent of all management groups and subscriptions in the directory. Regardless of how Subscription-A is moved between child management groups, it remains under the Tenant Root Group, meaning the policy continues to inherit.
3
Combine the results to select the matching option.
Identify the option stating that User1 loses the Reader role and the audit policy remains active.
This accurately reflects both inheritance rules during a subscription relocation.

Key Concept

Azure Policy and RBAC inheritance behavior during subscription relocation within a Management Group hierarchy.
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic