Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An administrator needs to configure access to an Azure resource group named 'App-RG'. A developer named User1 must be able to restart virtual machines and modify storage accounts inside 'App-RG'. However, User1 must not be allowed to delegate resource access permissions to other users.

Which of the following configurations should the administrator implement?

  1. Assign the Contributor role to User1 at the 'App-RG' scope.Answer
  2. B
    Assign the Reader role to User1 at the 'App-RG' scope and assign an Azure Policy that permits resource modifications.
  3. C
    Assign the Owner role to User1 at the 'App-RG' scope and apply a ReadOnly resource lock to 'App-RG'.
  4. D
    Create an Azure Policy assignment that grants write and restart actions specifically to User1's account.

Answer

Assign the Contributor role to User1 at the 'App-RG' scope.
The correct configuration is to assign the Contributor role at the resource group scope. In Azure RBAC, the Contributor role grants full access to manage resources, including restarting virtual machines and modifying storage accounts, but does not allow the user to assign roles to others. This satisfies both requirements of managing the resources and preventing permission delegation.

Step-by-Step Solution

1
Analyze the access requirements for User1.
User1 needs to manage resources (restart VMs, modify storage accounts) but must not be able to delegate permissions to others.
This determines the scope and the specific Azure built-in role needed for the user.
2
Compare built-in Azure RBAC roles.
The Contributor role grants full management capabilities but restricts authorization actions. The Owner role grants full management capabilities and permits authorization actions (delegation). The Reader role only allows read-only access.
Selecting the correct built-in role ensures least-privilege compliance.
3
Differentiate between Azure RBAC and Azure Policy.
Azure RBAC manages user permissions, while Azure Policy enforces compliance and resource properties (e.g., allowed VM sizes or regions).
This rules out options attempting to use Azure Policy to grant user access.

Key Concept

Azure Role-Based Access Control (RBAC)
Estimated Time:1m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic