Examkin

Question

Difficulty: HardAzure Role-Based Access Control (RBAC) Configuration and Roles

Your company has an Azure environment with the following resource hierarchy:
* Tenant Root Group (Management Group)
* Finance-MG (Management Group)
* Sub-Finance (Subscription)
* RG-Core (Resource Group)
* RG-Archive (Resource Group)
* storarchive (Storage Account)

You need to grant permissions to a user named User1 to perform the following tasks:
1. Manage virtual machines located in RG-Core.
2. Configure Azure Backup for the virtual machines in RG-Core, which includes creating a new Recovery Services vault inside RG-Core.
3. Read and write blob data within the containers of the storarchive storage account.

You must follow the principle of least privilege.

Which role assignments should you configure?

  1. Assign the Contributor role at the RG-Core scope, and the Storage Blob Data Contributor role at the storarchive scope.Answer
  2. B
    Assign the Contributor role at the RG-Core scope, and the Contributor role at the RG-Archive scope.
  3. C
    Assign the Contributor role at the Sub-Finance scope.
  4. D
    Assign the Contributor role at the RG-Core scope, and the Microsoft Entra ID Global Reader role.

Answer

Assign the Contributor role at the RG-Core scope, and the Storage Blob Data Contributor role at the storarchive scope.
The correct configuration provides the exact permissions required by the user while strictly adhering to the principle of least privilege. Assigning the Contributor role at the RG-Core scope grants the user write permissions to create the Recovery Services vault and manage VMs within that resource group only. Assigning the Storage Blob Data Contributor role at the storarchive scope grants the data-plane access needed to read and write blobs without giving the user administrative rights over the entire RG-Archive resource group.

Step-by-Step Solution

1
Analyze the requirements for RG-Core.
User1 needs to manage VMs and create a Recovery Services vault inside RG-Core.
Creating a Recovery Services vault requires write permissions on the resource group. The Contributor role at the RG-Core scope provides these write permissions along with VM management, restricting User1's administrative rights to this single resource group.
2
Analyze the requirements for the storage account.
User1 needs to read and write blob data inside the storarchive storage account.
Azure storage control-plane roles (like Contributor) do not grant direct data-plane access to blobs. To read and write blob data using Entra ID authorization, User1 must be assigned the Storage Blob Data Contributor role at the scope of the storarchive storage account.
3
Verify compliance with the principle of least privilege.
The combined role assignments limit User1's access to only the necessary resource scopes.
Assigning permissions at the resource group and resource level instead of the subscription level prevents over-provisioning access to other parts of the Azure environment.

Key Concept

Applying least privilege access by combining control-plane (Contributor) and data-plane (Storage Blob Data Contributor) roles at appropriate resource scopes.
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic