Examkin

Question

Difficulty: HardAzure Role Assignments and Scopes

An organization's Azure environment is structured with the following resource hierarchy:
- Management Group: `MG-Corporate`
- Subscription: `Sub-Corp-Prod`
- Resource Group: `RG-Analytics`
- Storage Account: `saanalytics`
- Key Vault: `kv-analytics`

A user named `User1` is assigned the Microsoft Entra ID `Global Administrator` role. `User1` is also assigned the following Azure role-based access control (RBAC) roles:
- The `Reader` role at the `MG-Corporate` management group scope.
- The `Storage Blob Data Reader` role at the `RG-Analytics` resource group scope.

`User1` does not elevate access in the Microsoft Entra admin center, and no other changes are made to the directory.

Which two actions can `User1` perform on the resources within the `RG-Analytics` resource group? (Select two.)

  1. Download files from a blob container inside the storage account `saanalytics`Answer
  2. View the configuration properties of the Key Vault `kv-analytics` in the Azure portalAnswer
  3. C
    Assign the Contributor role to another user for the Key Vault `kv-analytics`
  4. D
    Retrieve the secrets stored inside the Key Vault `kv-analytics`

Answer

The user can download files from a data container inside the storage account and view the configuration properties of the Key Vault in the Azure portal.
The user can perform the action to download files from a blob container inside the storage account because they are assigned the Storage Blob Data Reader role at the resource group level, which inherits down to the storage account and provides data plane read access. Additionally, the user can view the configuration properties of the Key Vault because they are assigned the Reader role at the management group level, which inherits down to the Key Vault and grants control plane read access.

Step-by-Step Solution

1
Determine control plane permissions from the management group assignment.
The user has Reader access inherited from the management group level down to the resource group and its child resources.
Azure RBAC assignments at higher scopes (such as management groups) are inherited down to all child scopes (subscriptions, resource groups, and resources).
2
Determine data plane permissions from the resource group assignment.
The user has Storage Blob Data Reader access inherited down to the storage account.
Assigning Storage Blob Data Reader at the resource group scope allows the user to read blobs from any storage account within that resource group due to inheritance.
3
Evaluate the effect of the Global Administrator role.
No subscription resource permissions are granted automatically by the Global Administrator role.
Microsoft Entra ID roles (such as Global Administrator) and Azure RBAC roles are separate. A Global Administrator must explicitly elevate their access to gain the User Access Administrator role at the root scope before managing subscription resources.
4
Compare the evaluated permissions against the proposed actions.
Viewing Key Vault configuration is allowed by Reader. Downloading blobs is allowed by Storage Blob Data Reader. Retrieving Key Vault secrets is blocked because Reader does not grant Key Vault data plane access. Managing role assignments is blocked because Global Administrator lacks resource permissions without elevation.
Aligning inherited permissions with each action reveals that only configuration viewing and blob downloading are permitted.

Key Concept

Azure RBAC inheritance and the boundary between Microsoft Entra ID administrator roles and Azure RBAC roles.
Estimated Time:2m 0s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic