Examkin

Question

Difficulty: Very hardAzure Role Assignments and Scopes

Your organization has an Azure tenant with the following resource hierarchy:
- Management Group: `MG-Enterprise`
- Subscription: `Sub-Finance-Prod`
- Resource Group: `RG-Finance-App`
- Key Vault: `kv-finance-prod`

You need to delegate permissions to a user named User1 to meet the following security requirements:
- User1 must be able to delegate role assignments to other administrators for resources within `RG-Finance-App` only.
- User1 must be able to view all resources and their configurations within `Sub-Finance-Prod`, but must not be able to create, modify, or delete any resources or configurations within the subscription.
- User1 must not be able to manage role assignments for resources outside of `RG-Finance-App`.

Which two role assignments should you configure to meet the requirements while adhering to the principle of least privilege?

  1. Assign the Reader role to User1 at the Sub-Finance-Prod subscription scope.Answer
  2. Assign the User Access Administrator role to User1 at the RG-Finance-App resource group scope.Answer
  3. C
    Assign the User Access Administrator role to User1 at the MG-Enterprise management group scope.
  4. D
    Assign the Global Administrator role to User1 in Microsoft Entra ID.
  5. E
    Assign the Contributor role to User1 at the RG-Finance-App resource group scope.

Answer

Assign the Reader role to User1 at the Sub-Finance-Prod subscription scope, and assign the User Access Administrator role to User1 at the RG-Finance-App resource group scope.
Assigning the Reader role at the subscription scope allows the user to view all resources and configurations within that subscription, which inherits down to the resource group level. Assigning the User Access Administrator role at the resource group scope allows the user to manage role assignments only within that specific resource group, without granting them permissions to modify resources themselves or manage access at higher scopes. This combination satisfies all security requirements under the principle of least privilege.

Step-by-Step Solution

1
Analyze the read-only requirement across the entire subscription.
Determined that the Reader role must be assigned at the subscription scope so that read access inherits down to all child resource groups and resources.
This satisfies the requirement to view all resources and configurations within the subscription without granting write access.
2
Analyze the access delegation requirement for the specific resource group.
Determined that the User Access Administrator role allows a user to manage role assignments (write/delete RBAC assignments) without granting data plane or control plane modification rights on the resources.
This isolates role management capabilities to the target resource group scope only, satisfying the scope boundary.
3
Verify the principle of least privilege is maintained.
Confirmed that combining Reader at the subscription scope and User Access Administrator at the resource group scope prevents the user from altering resources anywhere, while restricting role assignment management exclusively to the resource group.
Assigning roles at higher scopes (like management group) or using broader roles (like Owner or Global Administrator) would violate least privilege constraints.

Key Concept

Azure RBAC Scope Inheritance and Role Separation
Estimated Time:2m 0s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic