Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization's Azure environment features the following resource hierarchy:
- Tenant Root Group (Management Group)
- IT-MG (Management Group)
- Production-Sub (Subscription)
- App-RG (Resource Group)

You configure a system-assigned managed identity for an Azure App Service instance inside App-RG. You need to grant this managed identity the ability to view the configuration of all resources within App-RG. The identity must not be allowed to modify any resource configurations or change role assignments.

Which Azure role and scope should you assign to the managed identity to meet these requirements while adhering to the principle of least privilege?

  1. Assign the Reader role at the App-RG scope.Answer
  2. B
    Assign the User Administrator directory role in Microsoft Entra ID.
  3. C
    Assign the Reader role at the Tenant Root Group scope, and configure a Deny assignment for write operations at the App-RG scope.
  4. D
    Assign the Storage Blob Data Reader role at the App-RG scope.

Answer

Assign the Reader role at the App-RG scope.
Assigning the Reader role at the resource group scope (App-RG) is correct because it grants read-only access to all resources in that specific resource group, satisfying the requirement to view resource configurations without permitting modifications, while adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the target identity and the scope of access.
The target is a system-assigned managed identity, and the scope is the App-RG resource group.
Permissions should be assigned at the lowest scope that meets the requirements to satisfy the principle of least privilege.
2
Determine the required access permissions.
The identity needs to view configurations of all resources but must not modify resources or change assignments.
This aligns with the built-in Reader role, which permits read-only access to the resource control plane.
3
Assign the correct Azure RBAC role at the identified scope.
The Reader role is assigned directly to the managed identity at the App-RG scope.
This configuration provides the necessary read access to resources in the resource group while preventing unauthorized operations and access outside of App-RG.

Key Concept

Azure RBAC scopes and built-in roles application
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic