Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC)

A junior administrator needs to manage and restart virtual machines within a specific resource group. However, the administrator must not be allowed to grant access permissions to other users. Which Azure Role-Based Access Control (RBAC) role should you assign to meet this requirement?

  1. A
    Reader
  2. B
    Owner
  3. ContributorAnswer
  4. D
    Azure Policy

Answer

The Contributor role should be assigned because it allows managing and restarting virtual machines without granting access to other users.
The Contributor role is correct because it grants permissions to create and manage all types of Azure resources, including restarting virtual machines, but it does not allow the assignment of roles in Azure RBAC, satisfying the constraint of not being able to grant access to others.

Step-by-Step Solution

1
Identify the administrative tasks required: managing and restarting virtual machines.
This requires a role that can write/modify resources, which rules out the Reader role.
The Reader role only allows viewing configurations.
2
Identify the security constraint: the user must not be able to delegate permissions or assign roles.
This rules out the Owner role, which allows full access management.
The Owner role allows granting access to other users, violating the requirement.
3
Determine the appropriate built-in role and rule out non-RBAC options.
The Contributor role fits the requirements, while Azure Policy is ruled out because it manages resource compliance rather than user permissions.
Azure RBAC manages user access, and Contributor allows resource management without access delegation.

Key Concept

Azure Role-Based Access Control (RBAC) built-in roles and scope
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic