Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization's Azure infrastructure is structured as follows:
- Management Group: `MG-Core`
- Subscription: `Sub-Production`
- Resource Group: `RG-Networking` (contains a Virtual Network named `VNet-Prod` and three Network Security Groups)
- Resource Group: `RG-SecOps` (contains an Azure Key Vault and an Azure Firewall)

You have a Microsoft Entra ID group named `Net-Auditors`.

You need to assign Azure RBAC roles to `Net-Auditors` to meet the following requirements:
1. Members of `Net-Auditors` must be able to view all resource configurations and metrics across the entire `Sub-Production` subscription.
2. Members of `Net-Auditors` must be able to associate the existing Network Security Groups in `RG-Networking` to subnets in `VNet-Prod`.
3. The solution must minimize permissions (least privilege).

Which two role assignments should you configure? (Select two.)

  1. Assign the `Reader` role to `Net-Auditors` at the `Sub-Production` subscription scope.Answer
  2. Assign the `Network Contributor` role to `Net-Auditors` at the `RG-Networking` resource group scope.Answer
  3. C
    Assign the `Network Contributor` role to `Net-Auditors` at the `Sub-Production` subscription scope.
  4. D
    Assign the `Security Administrator` Microsoft Entra ID directory role to `Net-Auditors`.
  5. E
    Assign the `Owner` role to `Net-Auditors` at the `RG-Networking` resource group scope.

Answer

Assign the `Reader` role to `Net-Auditors` at the `Sub-Production` subscription scope, and assign the `Network Contributor` role to `Net-Auditors` at the `RG-Networking` resource group scope.
To satisfy the requirement of viewing all resource configurations and metrics across the entire subscription, the `Reader` role must be assigned to the `Net-Auditors` group at the subscription scope. To satisfy the requirement of linking Network Security Groups to subnets within the virtual network `VNet-Prod` while adhering to the principle of least privilege, the `Network Contributor` role must be assigned at the resource group scope (`RG-Networking`). Since both the Virtual Network and the NSGs reside in `RG-Networking`, assigning the role at this scope provides the necessary write actions (`Microsoft.Network/virtualNetworks/subnets/join/action` and `Microsoft.Network/networkSecurityGroups/join/action`) without granting administrative rights over resources in other resource groups, such as the Azure Firewall in `RG-SecOps`.

Step-by-Step Solution

1
Determine the role required to view all configurations and metrics across the entire subscription.
Assigning the `Reader` role at the subscription scope allows full read access to all resources and metrics without allowing any modifications.
This satisfies the requirement to view resource configurations subscription-wide.
2
Determine the role and scope required to link Network Security Groups to subnets.
Linking an NSG to a subnet requires write permissions on the subnet and the NSG. The `Network Contributor` role grants these network management privileges.
This role is necessary for subnet and network associations.
3
Identify the narrowest scope that covers the required network resources to enforce least privilege.
Since both the virtual network (`VNet-Prod`) and the NSGs are located in the `RG-Networking` resource group, assigning `Network Contributor` at the `RG-Networking` scope restricts the write access to only those resources, avoiding higher-level subscription access or access to the Azure Firewall in the `RG-SecOps` resource group.
This adheres to the principle of least privilege.

Key Concept

Azure Role-Based Access Control (RBAC) Scopes and built-in roles
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic