Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An administrator creates an Azure resource group named Dev-Web-RG. Is the following statement true or false?

To allow developers to manage existing resources in Dev-Web-RG, but prevent them from deploying other resource types (such as Virtual Machines) within that resource group, the administrator must assign the built-in Contributor role to the developers at the Dev-Web-RG scope.

Answer: Answer

Answer

False
The statement is false because Azure RBAC built-in roles like Contributor grant permission to manage and create all types of resources at their scope. They cannot restrict the specific types of resources (like Virtual Machines) that can be deployed. To enforce resource type restrictions, Azure Policy must be used.

Step-by-Step Solution

1
Analyze the requirement to limit the creation of specific resource types (such as Virtual Machines).
Identify that restricting which resource types can be deployed is a compliance and governance policy limit, not a basic access control permission.
This determines whether Azure RBAC or Azure Policy is the correct service to use.
2
Evaluate the permissions granted by the built-in Contributor role in Azure RBAC.
The Contributor role allows users to create and manage all types of Azure resources within the assigned scope, but does not allow them to grant access to others.
Assigning the Contributor role alone will fail to prevent developers from creating Virtual Machines.
3
Identify the correct Azure service for enforcing resource deployment compliance.
Azure Policy is designed to enforce rules and effects over Azure resources, including restricting allowed resource types.
Azure Policy is the correct governance tool to prevent unauthorized resource types from being deployed, proving that the statement about using RBAC is false.

Key Concept

Azure RBAC vs. Azure Policy
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic