Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

An organization manages an Azure tenant with the following resource hierarchy:
- Management Group: `MG-Healthcare`
- Subscription: `Sub-Clinical-Data`
- Resource Group: `RG-Patients`
- Storage Account: `sapatientrecords2026`
- Resource Group: `RG-Shared-Services`
- Virtual Machine: `VM-Gateway`

A user named `User-Auditor` is assigned the Global Administrator directory role in Microsoft Entra ID. No access elevation has been performed for this account. Additionally, `User-Auditor` is assigned the following Azure RBAC roles:
- The Reader role at the `MG-Healthcare` management group scope.
- The Virtual Machine Contributor role at the `RG-Shared-Services` resource group scope.

Which two of the following actions can `User-Auditor` perform? (Select two.)

  1. View the configuration settings and properties of the sapatientrecords2026 storage account.Answer
  2. Restart the VM-Gateway virtual machine.Answer
  3. C
    Assign the Reader role to another user at the Sub-Clinical-Data subscription level.
  4. D
    Read blob data stored in containers within the sapatientrecords2026 storage account.

Answer

The user can view the configuration properties of the storage account (due to the Reader role inherited from the management group) and restart the virtual machine (due to the Virtual Machine Contributor role assigned at the resource group).
Viewing the configuration properties of the storage account and restarting the virtual machine are possible because of role inheritance. The Reader role at the management group level inherits down to the storage account, allowing control-plane read access. The Virtual Machine Contributor role at the resource group level inherits down to the virtual machine, allowing actions such as restarting the VM.

Step-by-Step Solution

1
Analyze the management group Reader role scope.
The Reader role is assigned at MG-Healthcare. Due to inheritance, this grants read-only access to all resources in Sub-Clinical-Data, RG-Patients (including the storage account), and RG-Shared-Services (including the VM).
Azure RBAC assignments at a higher scope inherit down to all child scopes.
2
Analyze the resource group Virtual Machine Contributor role scope.
The Virtual Machine Contributor role is assigned at RG-Shared-Services. It inherits to VM-Gateway and permits VM management actions, such as restarting the VM.
Azure RBAC assignments inherit from the resource group level to resources within that group.
3
Evaluate the Global Administrator role capabilities.
The Global Administrator role is a directory role and does not grant permissions to Azure resources without access elevation.
Microsoft Entra ID and Azure RBAC have distinct authorization planes.
4
Evaluate data plane access to the storage account.
The Reader role only grants control plane access. It does not allow reading the actual blob contents inside the storage account.
Azure storage separates control plane operations from data plane operations.

Key Concept

Azure RBAC roles are applied at a specific scope (Management Group, Subscription, Resource Group, or Resource) and inherit down the hierarchy. Additionally, Microsoft Entra ID roles are separated from Azure RBAC resource roles, and control plane permissions do not grant data plane access by default.
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic