Examkin

Question

Difficulty: HardAzure Role Assignments and Scopes

An organization has the following Azure resource hierarchy and configuration:

* A management group named `MG-Finance`.
* An Azure subscription named `Sub-FinanceProd` that is associated with `MG-Finance`.
* A resource group named `RG-Payments` within `Sub-FinanceProd`.
* A virtual machine named `vm-pay1` and a storage account named `sa-paylogs` within `RG-Payments`.

The following role assignments are configured:

* `User1` is assigned the Microsoft Entra ID `Global Administrator` role. The directory setting Access management for Azure resources is set to No.
* `User2` is assigned the `Reader` role at the `MG-Finance` management group level, and the `Contributor` role at the `RG-Payments` resource group level.
* `User3` is assigned the `User Access Administrator` role at the `Sub-FinanceProd` subscription level.

Which TWO actions can be performed based on the configured permissions? (Select two.)

  1. User2 can create a new virtual machine in RG-Payments.Answer
  2. User3 can assign the Reader role to another user on vm-pay1.Answer
  3. C
    User1 can delete vm-pay1.
  4. D
    User2 can read blob data in sa-paylogs using Microsoft Entra ID authentication without any other role assignments.

Answer

User2 can create a new virtual machine in RG-Payments, and User3 can assign the Reader role to another user on vm-pay1.
The correct actions are those where the assigned roles grant the necessary control plane permissions at the appropriate scopes. The user assigned the Contributor role at the resource group level inherits write permissions within that specific scope, which allows virtual machine creation. The user assigned the User Access Administrator role at the subscription level inherits authorization management permissions, allowing role assignments on the virtual machine.

Step-by-Step Solution

1
Analyze the effective permissions of User1.
User1 is a Microsoft Entra ID Global Administrator but access elevation is set to No.
Verify if directory-level administrator roles automatically inherit subscription-level Azure resource permissions.
2
Analyze the effective permissions of User2.
User2 has Reader at the management group and Contributor at the resource group.
Determine the effective permissions at the resource group scope, noting that RBAC assignments are additive and the more permissive Contributor role applies locally.
3
Analyze the effective permissions of User3.
User3 has User Access Administrator at the subscription level.
Verify that the User Access Administrator role inherits to child resources to allow modifying role assignments.
4
Evaluate data plane access for User2 on the storage account.
User2 has Contributor on the resource group containing the storage account, but this does not grant data plane access for blobs via Microsoft Entra ID authentication.
Check the separation between control plane and data plane RBAC roles in Azure Storage.

Key Concept

Understanding Azure RBAC role assignments, scoping, inheritance, and the separation of Entra ID directory roles from Azure resource roles.
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic