Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC)

An administrator needs to configure access for a team of developers who must manage virtual machines. The virtual machines are located in an Azure resource group named Dev-RG, which is inside an Azure subscription named Sub1.

Which two of the following statements about managing access and governance in this scenario are correct?

  1. Assigning the Contributor role to the developers at the Sub1 subscription level will allow them to manage the virtual machines in Dev-RG.Answer
  2. Assigning the Reader role to the developers at the Dev-RG level will allow them to view the virtual machine configurations without making changes.Answer
  3. C
    Creating an Azure Policy at the Sub1 level is required to grant the developers permission to delete virtual machines in Dev-RG.
  4. D
    Applying a ReadOnly resource lock to Dev-RG is the standard method for granting the developers read-only permissions to the virtual machines.

Answer

Assigning the Contributor role to the developers at the Sub1 subscription level will allow them to manage the virtual machines in Dev-RG, and assigning the Reader role to the developers at the Dev-RG level will allow them to view the virtual machine configurations without making changes.
Azure Role-Based Access Control (RBAC) uses inheritance, meaning permissions granted at a subscription level flow down to containing resource groups and resources. Assigning the Contributor role at the subscription level allows the developers to manage resources in the resource group. Additionally, the Reader role is designed specifically to allow viewing of resources without permission to modify them.

Step-by-Step Solution

1
Analyze how permissions inherit in the Azure resource hierarchy.
Permissions assigned at a parent scope, such as the Sub1 subscription, propagate down to child scopes, such as the Dev-RG resource group and its virtual machines.
This confirms that assigning the Contributor role at the subscription level successfully delegates management permissions for the virtual machines.
2
Determine the role required for viewing configurations without making changes.
The Reader role provides read-only access to resources.
This confirms that assigning the Reader role at the Dev-RG level allows the developers to view the virtual machines without altering them.
3
Differentiate access management from policy enforcement and resource locking.
Azure Policy regulates resource compliance (e.g., allowed VM sizes), and resource locks prevent unauthorized deletion/modification. Neither is used to grant user permissions.
This helps rule out using Azure Policy or resource locks to delegate permissions to the developers.

Key Concept

Azure RBAC scope, built-in roles, and inheritance
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic