Examkin

Question

Difficulty: Very hardAzure Role-Based Access Control (RBAC)

An enterprise administrator is designing access controls for an Azure environment. A system auditor, User1, needs to inspect all resources across an Azure subscription named 'Subscription1'. Additionally, User1 must be able to perform management operations (such as starting, stopping, and restarting) on virtual machines within a specific resource group named 'RG-Prod'. However, User1 must not be allowed to modify permissions or assign roles to other users in any scope.

Which of the following configurations correctly implements these requirements?

  1. A
    Assign User1 the Reader role at the Subscription1 scope, and apply a ReadOnly resource lock to RG-Prod to ensure User1 cannot modify other resource types.
  2. Assign User1 the Reader role at the Subscription1 scope, and assign User1 the Virtual Machine Contributor role at the RG-Prod scope.Answer
  3. C
    Assign User1 the Reader role at the Subscription1 scope, and assign an Azure Policy to RG-Prod that grants User1 virtual machine management permissions.
  4. D
    Assign User1 the Contributor role at the Subscription1 scope, and assign an Azure Policy to Subscription1 that blocks User1 from delegating permissions.

Answer

Assign User1 the Reader role at the Subscription1 scope, and assign User1 the Virtual Machine Contributor role at the RG-Prod scope.
Assigning the Reader role at the Subscription1 scope and the Virtual Machine Contributor role at the RG-Prod scope correctly grants the ability to view all resources in the subscription, while also allowing virtual machine management within the specific resource group. Since neither role includes permissions to write role assignments, the security requirement of not allowing delegation is fully satisfied.

Step-by-Step Solution

1
Evaluate the requirement to inspect all resources across Subscription1.
Assigning the Reader role at the Subscription1 scope enables User1 to view all resources in the subscription and inherits down to all resource groups.
Ensures complete inspection capability across the target scope.
2
Evaluate the requirement to manage virtual machines within RG-Prod.
Assigning the Virtual Machine Contributor role at the RG-Prod scope grants permissions to perform VM operations (start, stop, restart) within that resource group.
Allows virtual machine management specifically within the required resource group without granting full contributor access to other resource types.
3
Verify the constraint preventing User1 from assigning roles or modifying permissions.
Neither the Reader role nor the Virtual Machine Contributor role has permission to write role assignments (Microsoft.Authorization/roleAssignments/write).
Guarantees that User1 cannot delegate permissions to other users.

Key Concept

Azure Role-Based Access Control (RBAC) role assignment, inheritance, and separation from Azure Policy and Resource Locks.
Estimated Time:3m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic