Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

An administrator manages an Azure resource hierarchy with the following structure:
* Management Group: `MG-Corporate`
* Subscription: `Sub-Production`
- Resource Group: `RG-AppData`
- Key Vault: `kv-prod-secrets`

A compliance auditor named `User-Auditor` requires the Reader role at the `Sub-Production` subscription level. However, organization policy dictates that `User-Auditor` must not be able to view any resources in `RG-AppData`. The administrator assigns the Reader role to `User-Auditor` at the `Sub-Production` subscription scope, and then attempts to assign a custom role that denies read actions to `User-Auditor` at the `RG-AppData` scope.

What is the effect of this configuration on the auditor's permissions?

  1. A
    The auditor will have read access to resources in Sub-Production but will be blocked from accessing resources in RG-AppData because the more specific assignment at the resource group scope overrides the subscription-level assignment.
  2. B
    The auditor will not have read access to any resources in the subscription unless they are also assigned a Microsoft Entra ID administrative role such as Security Reader.
  3. The auditor will have read access to all resources in both Sub-Production and RG-AppData because Azure RBAC role assignments are additive and standard RBAC does not support user-defined deny assignments.Answer
  4. D
    The auditor will have read access to Sub-Production, and the access to RG-AppData will be blocked only if RG-AppData is scoped to an Administrative Unit that restricts role inheritance.

Answer

The auditor will have read access to all resources in both Sub-Production and RG-AppData because Azure RBAC role assignments are additive and standard RBAC does not support user-defined deny assignments.
The correct answer is that the auditor will have read access to all resources in both Sub-Production and RG-AppData. In Azure RBAC, role assignments are additive. A user's effective permissions are the union of all roles assigned to them. Permissions inherited from a higher scope (Subscription) cannot be restricted or blocked by standard role assignments at a lower scope (Resource Group), as standard RBAC does not support user-defined deny assignments.

Step-by-Step Solution

1
Evaluate the effect of assigning the Reader role at the subscription level.
The User-Auditor is granted Reader permissions across all child scopes within the subscription, including the RG-AppData resource group.
Azure RBAC uses inheritance; permissions assigned at a higher scope flow down to all child scopes.
2
Evaluate the attempt to block access using a custom role at the resource group scope.
The attempt to block or deny access using a custom role at the resource group scope has no effect.
Azure RBAC is strictly additive. Standard custom roles and role assignments do not support deny actions; deny assignments can only be created by system processes such as Azure Blueprints or Deployment Stacks.
3
Determine the final combined permissions for the compliance auditor.
The compliance auditor retains read access to all resources under the Sub-Production subscription, including RG-AppData.
Because roles are additive and cannot be overridden by standard lower-scope assignments, the inherited Reader permission remains active.

Key Concept

Azure RBAC inheritance and additive permissions
Estimated Time:1m 30s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic