Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC)

An administrator assigns the Reader role to a user at the Azure subscription level. The subscription contains a resource group named RG1, which contains a virtual machine named VM1. Which of the following describes the user's permissions for VM1?

  1. The user can view VM1 but cannot modify or delete it.Answer
  2. B
    The user has no permissions on VM1 unless an Azure Policy is created to allow role inheritance.
  3. C
    The user has no permissions on VM1 because RBAC roles do not inherit from subscriptions to resource groups.
  4. D
    The user can view and modify VM1, but they are prevented from deleting it because a ReadOnly lock is automatically applied.

Answer

The user can view VM1 but cannot modify or delete it.
Assigning the Reader role at the subscription level automatically propagates permissions down the Azure resource hierarchy. This means the user inherits Reader permissions on the resource group and the virtual machine, allowing them to view the virtual machine's configurations but preventing them from modifying or deleting it.

Step-by-Step Solution

1
Identify the scope where the Azure RBAC role is assigned.
The Reader role is assigned at the subscription level.
Permissions in Azure RBAC propagate down the hierarchy from management groups, to subscriptions, to resource groups, and finally to resources.
2
Determine the inheritance of the Reader role for the resources inside the subscription.
The user inherits the Reader role for all resource groups (like RG1) and resources (like VM1) within that subscription.
Since inheritance is automatic and cannot be blocked at lower levels, the subscription-level Reader role applies to VM1.
3
Evaluate the capabilities of the Reader role on the target resource.
The user has view-only permissions for VM1 and cannot modify or delete it.
The built-in Reader role allows users to view resources but does not grant permissions to make changes or manage access.

Key Concept

Azure RBAC permissions inherit automatically from higher scopes (such as subscriptions) to lower scopes (such as resource groups and resources).
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic