Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization manages its Azure environment with the following hierarchy:

* Management Group: `MG-Corporate`
* Subscription: `Sub-Production`
* Resource Group: `RG-DataStorage` (contains multiple Azure Storage accounts)

A security group named `Data-Auditors` needs to inspect the configuration settings of the storage accounts within `RG-DataStorage` to verify compliance. The auditors must not have access to read, write, or delete the actual blob data stored inside these storage accounts, nor should they be able to modify the configurations of the storage accounts. To apply the principle of least privilege, which role assignment should you configure?

  1. Assign the Reader role to the Data-Auditors group at the scope of the RG-DataStorage resource group.Answer
  2. B
    Assign the Storage Blob Data Reader role to the Data-Auditors group at the scope of the RG-DataStorage resource group.
  3. C
    Assign the Global Reader directory role in Microsoft Entra ID to the Data-Auditors group.
  4. D
    Assign the Reader role to the Data-Auditors group at the scope of the MG-Corporate management group.

Answer

Assign the Reader role to the Data-Auditors group at the scope of the RG-DataStorage resource group.
Assigning the Reader role at the resource group scope (RG-DataStorage) provides read-only access to the control plane configurations of all resources within that resource group. Because the Reader role does not grant data-plane operations, the members of the security group cannot access the actual blob data inside the storage accounts. This configuration satisfies the requirements of configuration auditing and the principle of least privilege.

Step-by-Step Solution

1
Analyze the access requirements for the Data-Auditors group.
The group requires read-only access to configuration settings (control plane) but must not access actual data (data plane) or modify any resources.
This establishes the minimum permissions needed under the principle of least privilege.
2
Determine the appropriate scope for the assignment.
The scope should be limited to the RG-DataStorage resource group, rather than the entire management group (MG-Corporate), to prevent unnecessary access to other resources.
Restricting the scope ensures permissions do not inherit down to other unrelated resources.
3
Select the Azure RBAC role that separates control plane from data plane access.
The Reader role allows viewing resource configurations on the control plane but does not grant data-plane access (unlike Storage Blob Data Reader) or tenant-level admin permissions.
Matching the role to the control plane fulfills the least privilege compliance auditing requirement.

Key Concept

Azure RBAC scopes, control plane versus data plane access, and role inheritance.
Estimated Time:1m 30s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic