Examkin

Question

Difficulty: MediumAzure Role Assignments and Scopes

An organization manages its Azure resources using the following hierarchy:
* Subscription: `Sub-Dev-01`
* Resource Group: `RG-App-01`
* Virtual Machine: `vm-dev-01`
* Resource Group: `RG-Data-01`
* Storage Account: `sa-dev-01`

You configure the following role assignments and group memberships:
* A Microsoft Entra ID group named `Dev-Team` is assigned the Contributor role at the `RG-App-01` scope.
* A user named `DevUser1` is a member of the `Dev-Team` group.
* `DevUser1` is assigned the Reader role at the `Sub-Dev-01` subscription scope.
* `DevUser1` is assigned the Owner role at the `sa-dev-01` storage account scope.

Which of the following actions can `DevUser1` perform? (Select TWO.)

  1. Create a new virtual machine in RG-App-01Answer
  2. Assign the Reader role to another user on the sa-dev-01 storage accountAnswer
  3. C
    Delete the RG-Data-01 resource group
  4. D
    Create a new resource group under the Sub-Dev-01 subscription

Answer

The user can create a new virtual machine in RG-App-01 and assign the Reader role to another user on the sa-dev-01 storage account.
The correct options are creating a new virtual machine in RG-App-01 and assigning the Reader role to another user on the sa-dev-01 storage account. The Contributor role at the resource group level allows resource creation within that group, and the Reader assignment at the subscription level does not restrict this because Azure RBAC is additive. The Owner role on the storage account grants full management capabilities, including role assignments, specifically at that resource scope.

Step-by-Step Solution

1
Evaluate the permissions for RG-App-01.
The user is a member of Dev-Team, which has Contributor access at the resource group scope. Because Azure RBAC is additive, the Reader role assigned at the subscription scope does not override the Contributor role at the resource group scope. Therefore, the user can create resources in RG-App-01.
Azure RBAC roles are additive, meaning the effective permission is the union of all assignments.
2
Evaluate the permissions for the sa-dev-01 storage account.
The user has the Owner role assigned at the storage account scope. This role includes write permissions for role assignments on this specific resource, allowing the user to assign roles to others.
The Owner role contains permissions to modify access control (role assignments) at its assigned scope.
3
Evaluate the permissions for RG-Data-01 and the subscription.
The user only has Owner permissions at the storage account scope. These permissions do not inherit upwards to RG-Data-01. At the subscription scope, the user only has Reader access, which does not allow creating new resource groups.
Azure RBAC inheritance flows down the hierarchy (Subscription -> Resource Group -> Resource), never upwards.

Key Concept

Azure RBAC scopes, role inheritance, and the additive nature of role assignments.
Estimated Time:1m 30s
Rate this question

Topics

Azure Role Assignments and Scopes

More questions from this topic