Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An administrator needs to configure access and compliance for a development team. The requirements are:
1. A developer named Casey must be able to create and manage virtual machines within a resource group named Dev-RG.
2. Casey must not be allowed to grant other users access to the resource group.
3. The team must be prevented from deploying virtual machines that do not match a specific size configuration.

Which configuration should the administrator implement to meet these requirements?

  1. Assign Casey the Contributor role for Dev-RG, and assign an Azure Policy definition to prevent the deployment of non-compliant virtual machine sizes.Answer
  2. B
    Assign Casey an Azure Policy definition that grants resource creation permissions, and assign another Azure Policy definition to prevent the deployment of non-compliant virtual machine sizes.
  3. C
    Assign Casey the Contributor role for Dev-RG, and apply a ReadOnly resource lock to Dev-RG to prevent unauthorized modifications to the virtual machines.
  4. D
    Assign Casey the Contributor role for Dev-RG, and rely on Azure Policy to automatically delete any non-compliant virtual machines after they are deployed.

Answer

Assign Casey the Contributor role for Dev-RG, and assign an Azure Policy definition to prevent the deployment of non-compliant virtual machine sizes.
The correct configuration assigns Casey the Contributor role at the resource group scope, which permits full resource management (creation, deletion, modification) while preventing Casey from granting access to other users (a permission reserved for Owner or User Access Administrator roles). It also uses Azure Policy to enforce the VM size constraint, as RBAC cannot restrict resource properties like sizes.

Step-by-Step Solution

1
Identify the role needed to manage resources without delegating access control.
Casey requires the Contributor role because it allows full management of resources within the resource group scope but does not grant authorization capabilities.
The Owner role would violate the requirement by allowing Casey to assign roles to others.
2
Determine how to enforce compliance and configuration constraints.
Azure Policy must be used to block the deployment of non-compliant VM sizes.
Azure RBAC cannot restrict specific resource configurations or sizes; that is the role of Azure Policy.
3
Combine the access control and governance features into a single solution.
Assign Casey the Contributor role and assign the corresponding Azure Policy definition to the resource group.
This configuration satisfies all three requirements without using conflicting locks or expecting Azure Policy to perform tasks it cannot do.

Key Concept

Azure Role-Based Access Control (RBAC) vs Azure Policy
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic