Examkin

Question

Difficulty: HardAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization uses a multi-tier Azure resource hierarchy structure. The hierarchy contains a Management Group named Corp-MG, a subscription named Finance-Sub under Corp-MG, and a resource group named Finance-Prod-RG inside Finance-Sub. A compliance team needs to audit role assignments and resource configurations. They must be able to:

1. View all resource configurations inside the Finance-Sub subscription.
2. Read all logs and role assignments inside Finance-Prod-RG.
3. Manage (create, delete, and update) role assignments specifically within Finance-Prod-RG.

They must not be able to modify any resource configurations or access data plane objects (such as reading storage blob data or key vault secrets). You need to configure role assignments for the compliance team's security group.

Which two role assignments should you configure to meet the requirements while adhering to the principle of least privilege? (Select two.)

  1. Reader assigned at the Finance-Sub subscription levelAnswer
  2. User Access Administrator assigned at the Finance-Prod-RG resource group levelAnswer
  3. C
    User Access Administrator assigned at the Corp-MG management group level
  4. D
    Global Administrator assigned in the Microsoft Entra ID tenant
  5. E
    Storage Blob Data Reader assigned at the Finance-Prod-RG resource group level

Answer

Configure Reader assigned at the Finance-Sub subscription level and User Access Administrator assigned at the Finance-Prod-RG resource group level.
To satisfy the requirements using the principle of least privilege, the compliance team must be assigned the Reader role at the subscription scope (Finance-Sub), which allows them to view all configurations in the subscription and all child resource groups. Additionally, they must be assigned the User Access Administrator role at the resource group scope (Finance-Prod-RG), which enables them to manage role assignments only within that specific resource group without inheriting administrative rights upward or across other subscriptions.

Step-by-Step Solution

1
Analyze the requirement for viewing resource configurations.
The compliance team needs to view all resource configurations within the Finance-Sub subscription. The Reader role grants this read-only access. Assigning it at the subscription scope ensures it inherits to all child resource groups.
Ensures the team can audit resource configurations across the entire subscription scope.
2
Analyze the requirement for managing role assignments.
The compliance team must manage role assignments specifically within the Finance-Prod-RG resource group. The User Access Administrator role allows managing role assignments. To restrict this to the resource group, the role must be scoped at the Finance-Prod-RG level.
Adheres to the principle of least privilege by scoping administrative access to the specific resource group rather than the subscription or management group.
3
Verify exclusions and data plane access restrictions.
The combination of Reader (at subscription level) and User Access Administrator (at resource group level) does not grant data plane access (like reading storage blob data) or resource modification rights, meeting all security constraints.
Validates compliance with the constraint preventing data plane access or modification of configurations.

Key Concept

Azure RBAC inheritance, scope scoping, and the distinction between control plane (Reader, User Access Administrator) and data plane (Storage Blob Data Reader) roles.
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic