Examkin

Question

Difficulty: MediumManagement Groups Hierarchies

Apex Global Logistics configures the following Azure Management Group (MG) hierarchy:

* Tenant Root Group
* Logistics-MG
* Operations-MG
* Subscription-Ops1
* Archive-MG
* Subscription-Arch1

The following assignments and configurations are in place:
* An Azure Policy assignment that restricts resource deployment regions is applied to Logistics-MG.
* A user named User1 is assigned the Contributor role at the Operations-MG level.
* A Resource Lock of type CanNotDelete is applied directly to Subscription-Ops1.

You move Subscription-Ops1 from Operations-MG to Archive-MG.

Which of the following describes the impact of this move on User1's permissions and the policy and lock configurations of Subscription-Ops1?

  1. A
    User1 retains the Contributor role permissions on Subscription-Ops1 because permissions are cached, but the regional policy from Logistics-MG is no longer enforced.
  2. User1 loses the Contributor role permissions on Subscription-Ops1, while the regional policy from Logistics-MG and the CanNotDelete resource lock remain active on Subscription-Ops1.Answer
  3. C
    User1 loses the Contributor role permissions on Subscription-Ops1, and the regional policy from Logistics-MG stops being enforced on Subscription-Ops1 because policy evaluation is reset upon moving parent groups.
  4. D
    User1 loses the Contributor role permissions on Subscription-Ops1, but the CanNotDelete resource lock is automatically deleted because direct locks do not migrate with subscriptions.

Answer

User1 loses the Contributor role permissions on Subscription-Ops1, while the regional policy from Logistics-MG and the CanNotDelete resource lock remain active on Subscription-Ops1.
The correct option is correct because moving Subscription-Ops1 out of Operations-MG removes the subscription from the scope of User1's Contributor role assignment. Since Logistics-MG remains a parent of the subscription's new parent group (Archive-MG), the policy inherited from Logistics-MG continues to apply. Any resource locks applied directly to the subscription are properties of the subscription itself and remain intact after the move.

Step-by-Step Solution

1
Analyze RBAC scope inheritance during subscription relocation.
User1 loses Contributor permissions on Subscription-Ops1.
User1's role assignment is at the Operations-MG level. When Subscription-Ops1 is moved to Archive-MG, it is no longer a child of Operations-MG, so it stops inheriting permissions from that scope.
2
Analyze Azure Policy inheritance through the new hierarchy path.
The regional policy assigned at Logistics-MG remains active on Subscription-Ops1.
Archive-MG is a child of Logistics-MG. Therefore, Subscription-Ops1 still inherits the policy from Logistics-MG after the move.
3
Evaluate the state of the direct resource lock on the subscription.
The CanNotDelete resource lock remains active.
Direct resource locks applied to a subscription are properties of the subscription resource itself and are not deleted or altered when the subscription is moved between management groups.

Key Concept

Azure Management Groups govern subscription-level access, policy, and compliance through hierarchical inheritance.
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic