Examkin

Question

Difficulty: MediumManagement Groups Hierarchies

Luminary Media Group organizes its Azure resources using the following management group hierarchy:

* Tenant Root Group
* Luminary-MG (An administrator assigns User1 the Reader role here)
* Content-MG (An Azure Policy is assigned here that denies resource creation if the 'Department' tag is missing)
* Sub-Production (Subscription) (An administrator assigns User1 the Contributor role here)
* RG-Video (Resource Group) (A CanNotDelete resource lock is applied here)
* Marketing-MG
* Sub-Marketing (Subscription)

Which two of the following statements are correct regarding the permissions and governance applied to User1 in this hierarchy?

  1. User1 can view resources within the Sub-Marketing subscription, but cannot delete resources in the RG-Video resource group.Answer
  2. User1 can create new resources in the RG-Video resource group, provided they include the 'Department' tag.Answer
  3. C
    User1 can delete resources in the RG-Video resource group because the Contributor role at the subscription level overrides the CanNotDelete lock.
  4. D
    User1 is blocked from reading resources in the Sub-Marketing subscription because the Contributor assignment at Sub-Production restricts User1 to that scope only.

Answer

User1 can view resources within the Sub-Marketing subscription but cannot delete resources in the RG-Video resource group, and User1 can create new resources in the RG-Video resource group provided they include the 'Department' tag.
The correct options accurately identify that the Reader role assigned at the parent management group inherits down to the Sub-Marketing subscription, enabling read access. Furthermore, they correctly state that User1 has Contributor rights in RG-Video but cannot delete resources due to the CanNotDelete lock, and that new creations require the 'Department' tag due to the inherited Azure Policy from Content-MG.

Step-by-Step Solution

1
Evaluate Reader role inheritance
User1 is assigned the Reader role at Luminary-MG, which propagates down to all child scopes, including Marketing-MG and the Sub-Marketing subscription.
Permissions assigned at a parent management group are inherited by all child management groups, subscriptions, and resources.
2
Evaluate Contributor role and resource lock on RG-Video
User1 has Contributor permissions on Sub-Production and RG-Video, but the CanNotDelete lock on RG-Video prevents resource deletion.
Contributor rights allow creation and modification, but a CanNotDelete lock blocks delete operations for all users regardless of their RBAC roles.
3
Evaluate Azure Policy inheritance
Any resource creation in RG-Video must include the 'Department' tag to comply with the policy set at Content-MG.
Azure Policies applied at a management group level are inherited and enforced on all resources within that hierarchy.

Key Concept

Azure Management Groups allow for the hierarchical inheritance of RBAC roles, Azure Policies, and resource locks down to child subscriptions and resource groups.
Estimated Time:1m 30s
Rate this question

Topics

Management Groups Hierarchies

More questions from this topic