Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An organization is setting up an Azure environment and needs to delegate resource management for a development team. A deployment specialist must be able to create, modify, and delete virtual machines within a specific resource group named ProjectX-RG. However, the specialist must not be allowed to delegate access permissions to other users or manage resource locks on ProjectX-RG. Which of the following options should you configure to meet these requirements?

  1. Assign the Contributor role to the specialist at the resource group scopeAnswer
  2. B
    Assign the Owner role to the specialist at the resource group scope
  3. C
    Assign an Azure Policy definition to the resource group that allows virtual machine creation
  4. D
    Apply a ReadOnly resource lock to the ProjectX-RG resource group

Answer

Assign the Contributor role to the specialist at the resource group scope
Assigning the Contributor role at the resource group scope allows the specialist to create and manage virtual machines within the specified resource group. The Contributor role does not grant permissions to manage access controls (which requires Owner or User Access Administrator) or change resource locks, satisfying all constraints.

Step-by-Step Solution

1
Analyze the access control requirements for the specialist, which are managing virtual machines (create, modify, delete) without the ability to delegate access or manage locks.
Identified that the role must allow resource modification but restrict authorization/management tasks.
This establishes the scope of permissions needed.
2
Evaluate Azure Role-Based Access Control (RBAC) built-in roles.
The Contributor role grants full access to manage resources but does not allow assigning roles in Azure RBAC, which perfectly matches the requirements.
This distinguishes between Contributor and Owner roles.
3
Verify that Azure Policy and Resource Locks cannot be used to grant user permissions in this scenario.
Azure Policy regulates resource properties, and a ReadOnly lock would block all modifications.
This rules out non-RBAC options that would block the required actions.

Key Concept

Azure Role-Based Access Control (RBAC) manages access by assigning roles (like Owner and Contributor) at specific scopes, while Azure Policy enforces compliance and Resource Locks prevent accidental changes.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic