Examkin

Question

Difficulty: HardAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization's Azure environment is configured with the following resource hierarchy:
- Tenant Root Group (Management Group)
- Group-MG (Management Group)
- Billing-Sub (Subscription)
- Data-RG (Resource Group)
- storage1 (Storage Account)

A security administrator needs to delegate authority to a user named Admin-User1. Admin-User1 must be able to assign the Reader role to external auditors for resources within Data-RG. Admin-User1 must not be able to modify the resources themselves, nor assign roles for any resources outside of Data-RG.

Which of the following actions should the administrator perform to meet these requirements with the least privilege?

  1. Assign the User Access Administrator role to Admin-User1 at the scope of the Data-RG resource group.Answer
  2. B
    Assign the Owner role to Admin-User1 at the scope of the Data-RG resource group.
  3. C
    Assign the Global Administrator role to Admin-User1 in Microsoft Entra ID.
  4. D
    Assign the User Access Administrator role to Admin-User1 at the scope of the Billing-Sub subscription.

Answer

Assign the User Access Administrator role to Admin-User1 at the scope of the Data-RG resource group.
Assigning the User Access Administrator role at the resource group scope (Data-RG) allows the user to manage role assignments (such as assigning the Reader role) only within that specific resource group. Since User Access Administrator does not grant permissions to modify the resources themselves (which would require a role like Contributor or Owner), it satisfies the requirement of least privilege.

Step-by-Step Solution

1
Determine the narrowest resource scope required for role delegation.
The target scope is the Data-RG resource group.
Assigning permissions at the subscription scope (Billing-Sub) would violate requirements by allowing role assignments in other resource groups via inheritance.
2
Evaluate the administrative role that allows assigning roles without permitting resource modification.
The User Access Administrator role is selected.
The Owner role would grant resource modification permissions, violating the restriction against resource changes.
3
Verify that Azure resource RBAC is used instead of Microsoft Entra ID directory roles.
Avoid tenant-level roles like Global Administrator.
Directory roles govern identity management rather than subscription resource-level RBAC assignments, and they exceed the scope of least privilege.

Key Concept

Azure RBAC scopes, role delegation, and the difference between Owner and User Access Administrator roles.
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic