Examkin

Question

Difficulty: Very hardAzure Role-Based Access Control (RBAC) Configuration and Roles

Your company's Azure environment is organized under a Root Management Group and a Production Management Group. It contains Subscription A, which hosts two resource groups: RG1 (containing a storage account named sa-prod-01 and a Key Vault named kv-prod-01) and RG2 (containing multiple virtual machines). You need to configure access for a Microsoft Entra ID security group named DevOps-Staff to meet the following requirements:

1. Members must be able to create, delete, and manage virtual machines within RG2.
2. Members must be able to configure Azure role assignments on resources inside RG1.
3. Members must not have permissions to modify, delete, or write configuration settings to the sa-prod-01 storage account.

Which two of the following role assignments should you configure to meet the requirements while adhering to the principle of least privilege?

  1. Assign the Virtual Machine Contributor role to the DevOps-Staff group at the RG2 scope.Answer
  2. Assign the User Access Administrator role to the DevOps-Staff group at the RG1 scope.Answer
  3. C
    Assign the Privileged Role Administrator directory role in Microsoft Entra ID to the DevOps-Staff group.
  4. D
    Assign the Contributor role to the DevOps-Staff group at the Subscription A scope, and apply an Azure RBAC deny assignment on the sa-prod-01 storage account.

Answer

To meet the requirements, assign the Virtual Machine Contributor role to the DevOps-Staff group at the RG2 scope, and assign the User Access Administrator role to the DevOps-Staff group at the RG1 scope.
Assigning the Virtual Machine Contributor role at the RG2 scope allows management of virtual machines within that resource group, satisfying the first requirement under the principle of least privilege. Assigning the User Access Administrator role at the RG1 scope enables managing role assignments on resources inside RG1 without granting control plane write or delete permissions over the resources, satisfying the second and third requirements.

Step-by-Step Solution

1
Address the requirement to create and manage virtual machines within RG2.
Identify that the Virtual Machine Contributor role contains the required actions to manage VMs but limits its scope to RG2, adhering to least privilege.
Assigning permissions at the resource group scope prevents horizontal privilege escalation to other resource groups such as RG1.
2
Address the requirement to manage role assignments in RG1 without modifying sa-prod-01.
Identify that the User Access Administrator role permits authorization modifications (Microsoft.Authorization/*) at the RG1 scope, but lacks data plane or control plane write permissions on storage resources.
This configuration satisfies the access-management goal while preventing structural modifications to the storage account or other resources within RG1.
3
Evaluate and rule out directory-level administrative roles.
Confirm that Microsoft Entra ID roles (like Privileged Role Administrator) do not grant access to Azure subscription-level resources or local role-assignment management.
Azure Resource RBAC and Microsoft Entra ID roles exist in separate authorization planes.
4
Evaluate and rule out custom deny assignment configurations.
Verify that Azure RBAC is an additive-only permission model for user-defined assignments and does not support user-created deny assignments.
Deny assignments are restricted to system-level policies and deployments, meaning a Contributor assignment at the subscription scope cannot be customized with a selective block.

Key Concept

Azure RBAC scopes, built-in resource roles (User Access Administrator and Virtual Machine Contributor), Entra ID directory roles vs. Azure resource roles, and the read-only nature of deny assignments.
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic