Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization manages its cloud resources using the following Azure hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-AppStore`
- Resource Groups: `RG-Services` and `RG-Database`

You need to delegate the ability to manage Azure Role-Based Access Control (RBAC) role assignments for all current and future resource groups inside `Sub-AppStore` to a security group named `Group-SecurityAdmins`. Members of `Group-SecurityAdmins` must not be able to create, delete, or modify any actual resources within the subscription.

Which role and scope should you assign to `Group-SecurityAdmins` to meet the requirements while adhering to the principle of least privilege?

  1. User Access Administrator at the `Sub-AppStore` subscription scopeAnswer
  2. B
    Owner at the `Sub-AppStore` subscription scope
  3. C
    User Access Administrator at the `RG-Services` and `RG-Database` resource group scopes
  4. D
    User Administrator in Microsoft Entra ID

Answer

Assign the User Access Administrator role at the `Sub-AppStore` subscription scope.
Assigning the User Access Administrator role at the `Sub-AppStore` subscription scope is correct because the User Access Administrator role is designed specifically to manage access to Azure resources (RBAC assignments) without granting the ability to create, delete, or modify the resources themselves. Because Azure RBAC assignments inherit down the hierarchy, configuring this role at the subscription level automatically extends the access to all current and future resource groups inside that subscription, satisfying the least privilege requirement.

Step-by-Step Solution

1
Identify the administrative requirement and scope.
The requirement is to manage role assignments for all current and future resource groups in the `Sub-AppStore` subscription.
This determines the scope of the assignment. Because role assignments are inherited downward in the Azure resource hierarchy, assigning a role at the subscription scope ensures it automatically applies to all existing and future resource groups within that subscription.
2
Determine the least-privileged role that allows managing role assignments.
The User Access Administrator role allows managing Azure resource access (RBAC assignments) but does not allow resource modification, unlike the Owner role which grants full control.
This aligns with the principle of least privilege, ensuring that users can perform the necessary administrative tasks without having excess permissions to modify or delete resources.
3
Differentiate between Azure RBAC roles and Microsoft Entra ID roles.
Microsoft Entra ID roles like User Administrator operate at the directory level and cannot manage Azure resource RBAC assignments directly.
This rules out directory roles which do not have authority over subscription-level resources.

Key Concept

Azure RBAC inheritance and the distinction between the Owner and User Access Administrator roles for least privilege.
Estimated Time:1m 30s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic