Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

A company has an Azure environment with a management group named Tenant-MG. Under Tenant-MG, there is a subscription named Enterprise-Sub, which contains a resource group named App-RG.

An administrator needs to assign permissions to a developer named Jordan. Jordan must be able to view all resources across the entire Enterprise-Sub subscription, but must only be able to create and manage resources within App-RG.

Which combination of role assignments should the administrator configure?

  1. A
    Assign Jordan the Contributor role at the Enterprise-Sub scope, and assign an Azure Policy that denies resource creation outside of App-RG.
  2. B
    Assign Jordan the Reader role at the Tenant-MG scope, and the Owner role at the App-RG scope.
  3. C
    Assign Jordan the Contributor role at the Tenant-MG scope, and apply a ReadOnly resource lock to all resource groups in Enterprise-Sub except App-RG.
  4. Assign Jordan the Reader role at the Enterprise-Sub scope, and the Contributor role at the App-RG scope.Answer

Answer

Assign Jordan the Reader role at the Enterprise-Sub scope, and the Contributor role at the App-RG scope.
Assigning the Reader role at the subscription scope (Enterprise-Sub) ensures that the permissions inherit down to all resource groups and resources within that subscription, allowing the user to view everything. Assigning the Contributor role at the resource group scope (App-RG) grants the necessary permissions to create and manage resources specifically within that resource group. Since Azure RBAC permissions are additive, the user will have Contributor access in App-RG and Reader access elsewhere in the subscription.

Step-by-Step Solution

1
Analyze the read-only requirement.
Determine the appropriate scope and role for viewing all subscription resources.
To grant read access across the entire subscription, the Reader role should be assigned at the subscription scope (Enterprise-Sub). This permission inherits down to all resource groups and resources within that subscription.
2
Analyze the write/management requirement.
Determine the appropriate scope and role for resource creation and management.
To restrict resource creation and management to a single resource group, the Contributor role should be assigned at the resource group scope (App-RG).
3
Combine the roles using Azure RBAC inheritance and additive rules.
The final permission set allows Jordan to view all resources in the subscription and manage resources within App-RG.
Azure RBAC permissions are additive. When Jordan accesses App-RG, the inherited Reader role and the direct Contributor role combine, giving Jordan Contributor rights inside App-RG, while retaining only Reader rights elsewhere in the subscription.

Key Concept

Azure RBAC scopes, built-in roles, and permission inheritance
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic