Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An administrator needs to restrict developers from deploying any resources other than storage accounts inside a resource group named 'Data-Prod-RG'. Is it true or false that the administrator can enforce this deployment restriction by assigning a custom Azure Role-Based Access Control (RBAC) role to the developers?

Answer: Answer

Answer

False
The correct answer is False because Azure RBAC manages access and permissions (who can do what), while Azure Policy is used to enforce resource properties and compliance rules, such as restricting the types of resources that can be deployed.

Step-by-Step Solution

1
Analyze the administrator's requirement, which is to restrict the types of resources (only allowing storage accounts) that can be deployed in the 'Data-Prod-RG' resource group.
Identified the goal as resource compliance and governance (restricting resource types).
Understanding the goal helps determine which Azure service or feature is appropriate.
2
Determine the capabilities of Azure Role-Based Access Control (RBAC).
Azure RBAC manages user access and permissions (who can perform write/read/delete actions on resources). It cannot inspect or restrict resource properties or resource types during deployment.
Verifying if RBAC can meet the requirement is necessary to evaluate the statement.
3
Identify the correct Azure feature for enforcing resource deployment constraints.
Azure Policy is the service used to enforce rules and effects (like denying non-conforming resource types) over resources.
Confirms that Azure Policy, not Azure RBAC, is the correct tool, rendering the statement false.

Key Concept

Azure RBAC vs Azure Policy
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic