Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An enterprise structures its resources using an Azure Management Group named 'Enterprise-MG'. This management group contains a single Azure subscription named 'Core-Sub'. Within 'Core-Sub', there is a resource group named 'Data-RG' containing an Azure SQL Database. You assign a user named Chloe the Reader role at the 'Enterprise-MG' level and the Contributor role at the 'Data-RG' level. Which of the following statements are true regarding Chloe's access permissions? (Select TWO).

  1. Chloe can delete the Azure SQL Database in the 'Data-RG' resource group.Answer
  2. Chloe can view all resources in the 'Core-Sub' subscription.Answer
  3. C
    Chloe can configure an Azure Policy to restrict database deployment regions.
  4. D
    Chloe can modify the Azure SQL Database even if a ReadOnly resource lock is applied to 'Data-RG' because she is a Contributor.

Answer

Chloe can delete the Azure SQL Database in the 'Data-RG' resource group, and she can view all resources in the 'Core-Sub' subscription.
The Reader role assigned at the management group level ('Enterprise-MG') is inherited by all child resources, meaning Chloe can view all resources within the child subscription ('Core-Sub'). Additionally, the Contributor role assigned directly to the resource group ('Data-RG') allows Chloe to modify and delete resources within that group, such as the Azure SQL Database.

Step-by-Step Solution

1
Analyze Chloe's direct role assignments and their respective scopes.
Chloe is assigned the Reader role at the management group ('Enterprise-MG') level and the Contributor role at the resource group ('Data-RG') level.
This establishes the entry points of her permissions in the Azure resource hierarchy.
2
Apply the principles of Azure RBAC inheritance to propagate permissions downward.
The Reader role propagates from the management group down to the child subscription ('Core-Sub') and all resource groups inside it. The Contributor role only applies within the 'Data-RG' resource group.
Permissions in Azure flow down the hierarchy (Management Group -> Subscription -> Resource Group -> Resource).
3
Evaluate the statements against Chloe's effective permissions and resource controls.
She can view resources across the subscription due to inherited Reader rights, and manage/delete resources inside 'Data-RG' due to Contributor rights. She cannot assign policies (which is Azure Policy, not RBAC) and cannot bypass a ReadOnly lock (which overrides Contributor permissions).
To identify which actions are valid based on RBAC inheritance rules and other governance features.

Key Concept

Azure RBAC inheritance and scope propagation
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic