Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization's Azure environment is structured with the following resource hierarchy:
- Tenant Root Group (Management Group)
- Security-MG (Management Group)
- Subscription1 (Subscription)
- RG-Secure (Resource Group)

You need to grant a security auditor named Auditor1 the ability to view all resources and access control assignments within RG-Secure. Auditor1 must not be able to modify any resources or manage access control assignments.

Which role should you assign to Auditor1 to meet the requirement under the principle of least privilege?

  1. Reader assigned at the RG-Secure scopeAnswer
  2. B
    Global Reader assigned in Microsoft Entra ID
  3. C
    Reader assigned at the Subscription1 scope, with a Deny assignment at the RG-Secure scope
  4. D
    Storage Blob Data Reader assigned at the RG-Secure scope

Answer

Reader assigned at the RG-Secure scope
The Reader role at the RG-Secure scope allows the auditor to view all resources and access control configurations in that specific resource group without modifying them or inheriting broader permissions from higher scopes, adhering to the principle of least privilege.

Step-by-Step Solution

1
Determine the required access levels.
The requirement is read-only access (viewing resources and access control assignments) without write or management permissions.
This points to the built-in Reader role, which permits read operations but no write or action operations.
2
Identify the correct scope according to the principle of least privilege.
The target scope is the resource group RG-Secure, rather than the entire Subscription1 or Security-MG.
Assigning permissions at the resource group level ensures the user only has access to the specified resources, not the entire subscription.
3
Verify if Microsoft Entra ID roles are appropriate.
Directory roles like Global Reader do not grant control plane access to subscription resources by default.
Azure RBAC roles and Microsoft Entra ID roles operate on different control planes, and Azure RBAC is required here.

Key Concept

Azure RBAC Built-in Roles and Scopes
Estimated Time:1m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic