Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization's Azure environment is structured with the following hierarchy:
- Management Group: `MG-Finance`
- Subscription: `Sub-Auditing`
- Resource Group: `RG-Compliance`
- Storage Account: `saaudits` (located in `RG-Compliance`)

A user named AuditAdmin1 must be able to read blob logs stored in a container named `logs-2026` inside the storage account `saaudits`. AuditAdmin1 must also be able to view the configuration settings of all resources within the `RG-Compliance` resource group, but must not be able to modify any resources or configuration settings. Which of the following configurations meets the requirements while applying the principle of least privilege?

  1. Assign the Reader role for the RG-Compliance resource group, and assign the Storage Blob Data Reader role for the saaudits storage account.Answer
  2. B
    Assign the Reader role for the MG-Finance management group, and assign the Storage Blob Data Reader role for the Sub-Auditing subscription.
  3. C
    Assign the Reader role for the RG-Compliance resource group, and assign the Reader role for the saaudits storage account.
  4. D
    Assign the Security Reader role in Microsoft Entra ID, and assign the Reader role for the saaudits storage account.

Answer

Assign the Reader role for the RG-Compliance resource group, and assign the Storage Blob Data Reader role for the saaudits storage account.
The correct configuration applies the Reader role at the resource group scope to satisfy the control-plane view requirement, and the Storage Blob Data Reader role at the storage account scope to satisfy the data-plane read requirement. This ensures the user has exactly the permissions needed without any write/modify permissions or access to adjacent resources.

Step-by-Step Solution

1
Identify the control-plane requirement.
The user needs to view resource configurations in the RG-Compliance resource group without modifying them. This maps to the Reader role at the RG-Compliance scope.
Applying the role at the resource group scope ensures least privilege compared to higher scopes like management groups or subscriptions.
2
Identify the data-plane requirement.
The user needs to read blob logs inside the saaudits storage account. This maps to the Storage Blob Data Reader role at the saaudits scope.
Azure RBAC separates control-plane operations (viewing resources) from data-plane operations (reading blob data). The standard Reader role does not grant blob data access, so a specialized data-plane role must be assigned.
3
Combine assignments to form the least privilege configuration.
The combination of the Reader role on the resource group and the Storage Blob Data Reader role on the storage account satisfies all requirements without granting excess permissions.
This target assignment ensures the user cannot modify resources and has no access to other resource groups or subscriptions.

Key Concept

Applying Azure RBAC roles at the appropriate scope using the principle of least privilege, distinguishing between control-plane and data-plane access, and avoiding Entra ID directory roles for Azure resources.
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic