Examkin

Question

Difficulty: EasyAzure Role Assignments and Scopes

Your company has an Azure subscription named Sub1 that contains a resource group named RG1. You need to ensure that a user named User1 can view all resources inside RG1. User1 must not be able to view resources in any other resource groups within Sub1, nor modify any resources. Which action should you perform?

  1. A
    Assign the Reader role to User1 at the Sub1 subscription scope.
  2. Assign the Reader role to User1 at the RG1 resource group scope.Answer
  3. C
    Assign the Global Administrator role to User1 in Microsoft Entra ID.
  4. D
    Assign the Reader role to User1 at the scope of an Administrative Unit containing RG1.

Answer

Assign the Reader role to User1 at the RG1 resource group scope.
Assigning the Reader role at the resource group scope grants the user read-only permissions for all resources within that specific resource group. Because the scope is restricted to the resource group, the user cannot view resources in other resource groups within the subscription, satisfying all requirements.

Step-by-Step Solution

1
Determine the minimum permission required to view resources.
The Reader role is identified as the appropriate built-in role to view resources without permission to modify them.
The Reader role allows viewing resources but does not allow any modifications.
2
Determine the correct scope for the role assignment to restrict access to a single resource group.
The resource group (RG1) scope is selected.
Assigning a role at the resource group scope limits the permissions to only that resource group, whereas assigning it at the subscription scope would allow inheritance to all other resource groups in the subscription.

Key Concept

Azure RBAC inheritance and scopes
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic