Examkin

Question

Difficulty: HardAzure Role-Based Access Control (RBAC)

An organization has an Azure subscription named Sub1 that contains a resource group named RG-Web. You need to configure the environment to meet the following requirements:

* A security auditor named Taylor must be able to assign roles and manage access permissions for other users on all resources inside RG-Web, but Taylor must not be able to create, modify, or delete any resources.
* All resources deployed within Sub1 must be restricted to a specific list of approved Azure regions.

Which configuration should you implement to meet these requirements?

  1. A
    Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign a custom Azure Role-Based Access Control (RBAC) role at the Sub1 scope to restrict the allowed regions.
  2. B
    Assign the User Access Administrator role to Taylor for a parent resource group nested inside RG-Web, and assign an Azure Policy definition at the Sub1 scope.
  3. Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign an Azure Policy definition at the Sub1 scope.Answer
  4. D
    Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign a ReadOnly resource lock at the Sub1 scope to restrict the allowed regions.

Answer

Assign the User Access Administrator role to Taylor at the RG-Web scope, and assign an Azure Policy definition at the Sub1 scope.
Assigning the User Access Administrator role at the RG-Web scope grants the permissions to manage user access and role assignments on all resources inside that resource group, but does not allow creating or deleting the resources themselves. Assigning an Azure Policy at the Sub1 scope ensures that all resources deployed within the subscription comply with the specified regional restrictions, as policies are inherited by child resource groups and resources.

Step-by-Step Solution

1
Determine the appropriate Azure RBAC role and scope for the security auditor.
Identify the User Access Administrator role assigned at the RG-Web resource group level.
This role grants the required permission to assign roles and manage access for others without granting permissions to write, delete, or modify the underlying resources. Assigning it at the RG-Web scope follows the principle of least privilege.
2
Select the correct mechanism to restrict resource deployment regions.
Identify Azure Policy as the compliance enforcement mechanism.
Azure Policy is designed to enforce compliance and resource properties, such as restricting allowed deployment regions. Azure RBAC controls authorization/access, while resource locks block deletions or modifications entirely.
3
Determine the proper scope for the regional restriction.
Apply the Azure Policy definition at the Sub1 subscription level.
The requirement specifies that all resources deployed within the subscription must be restricted. Assigning the policy at the subscription level ensures that all existing and future resource groups and resources under it inherit and enforce the policy.

Key Concept

Understanding the difference between Azure RBAC (access control) and Azure Policy (resource compliance/properties), along with resource group hierarchy rules.
Estimated Time:2m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic