Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

Your company has an Azure environment with a management group named MG1, a subscription named Sub1 under MG1, and a resource group named RG1 in Sub1. You need to assign permissions to your security and operations teams using Azure built-in roles.

Which of the following statements regarding the behavior of Azure Role-Based Access Control (RBAC) in this environment are correct? (Select two.)

  1. A user assigned the Reader role at the MG1 management group level will have read-only access to all resource groups and resources in Sub1 due to role inheritance.Answer
  2. A user assigned the Contributor role at the Sub1 subscription level can manage resources within RG1, but cannot grant permissions to other users.Answer
  3. C
    An administrator can assign a built-in Azure RBAC role at the Sub1 level to prevent developers from deploying virtual machines in any region other than East US.
  4. D
    To ensure that only resources with a specific cost-center tag can be created in RG1, you must assign the User Access Administrator role to the deployment team.

Answer

The correct statements are that assigning the Reader role at the management group level grants read-only access to child subscriptions and resources due to role inheritance, and that a user with the Contributor role at the subscription level can manage resources within child resource groups but cannot grant permissions to other users.
Role assignments in Azure RBAC inherit down the resource hierarchy. Because MG1 is the parent of Sub1, assigning the Reader role at MG1 grants read-only access to all child resources within Sub1. Additionally, the Contributor role permits full resource management capabilities but explicitly lacks permissions to assign roles or delegate access to others. Therefore, a user with Contributor rights on Sub1 can create and modify resources within RG1 but cannot grant access to other identities.

Step-by-Step Solution

1
Analyze role inheritance in the Azure hierarchy.
Permissions assigned at a parent scope (Management Group) inherit down to child scopes (Subscription, Resource Group, Resources). Thus, the Reader role at MG1 propagates to Sub1 and RG1.
To determine how assigning roles at different levels affects access down the hierarchy.
2
Evaluate the permissions of the Contributor role.
The Contributor role allows creating and managing resources but does not permit writing role assignments (delegating permissions). These permissions inherit from Sub1 down to RG1.
To verify if the Contributor role can manage resources and delegate access.
3
Distinguish between Azure RBAC and Azure Policy.
Enforcing resource compliance rules (like geographic region constraints or mandatory tags) requires Azure Policy. Azure RBAC only manages user access control.
To identify and eliminate options that incorrectly describe Azure Policy capabilities as RBAC functions.

Key Concept

Azure Role-Based Access Control (RBAC) scopes, inheritance, and distinction from Azure Policy.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic