Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An IT administrator assigns a user named User1 the Contributor role at the resource group level for a resource group named Dev-RG. Which of the following actions is User1 permitted to perform? (Select TWO.)

  1. Create new virtual machines within Dev-RG.Answer
  2. Delete existing storage accounts within Dev-RG.Answer
  3. C
    Enforce a rule requiring all new resources in Dev-RG to have a specific cost-center tag.
  4. D
    Block deployments of virtual machines in Dev-RG that exceed a specified CPU core limit.

Answer

Creating new virtual machines within Dev-RG and deleting existing storage accounts within Dev-RG.
The Contributor role allows a user to perform all resource management tasks within the target scope, which includes creating virtual machines and deleting storage accounts. Since the scope is the resource group Dev-RG, these operations are allowed on any resources contained inside it.

Step-by-Step Solution

1
Analyze the assigned Azure RBAC role and its scope.
User1 is assigned the Contributor role at the resource group level (Dev-RG).
Understanding the role and its scope defines the boundaries of what the user can do and where those actions are applied.
2
Evaluate the capabilities of the Contributor role.
The Contributor role grants full access to manage (create, read, update, delete) all resources within the scope, but it does not allow granting access to others.
This identifies that creating virtual machines and deleting storage accounts are permitted resource management activities.
3
Evaluate compliance and property enforcement actions against Azure governance features.
Enforcing tagging rules and blocking deployments based on resource specifications (like CPU limits) require Azure Policy, not RBAC.
This distinguishes between identity-based authorization (RBAC) and resource compliance/configuration enforcement (Azure Policy).

Key Concept

Azure Role-Based Access Control (RBAC) vs Azure Policy
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic