Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

To prevent a specific user from deleting virtual machines in an Azure resource group, you should assign an Azure Policy definition that denies the delete action on virtual machines.

Answer: Answer

Answer

False
The correct answer is False because controlling what actions a specific user can perform, such as preventing them from deleting virtual machines, is managed through Azure Role-Based Access Control (RBAC) rather than Azure Policy. Azure Policy focuses on resource governance and properties at a scope, and does not target specific users.

Step-by-Step Solution

1
Identify the goal of the governance requirement.
The goal is to restrict a specific user from performing a management action, which is deleting virtual machines.
Determining whether the goal is user authorization or resource compliance helps select the correct Azure service.
2
Evaluate the role of Azure Policy.
Azure Policy is used to enforce resource properties and compliance at a scope (e.g., ensuring resource tags exist or restricting VM sizes) and applies to all actions within that scope regardless of the user.
This rules out Azure Policy for user-specific permission control.
3
Evaluate the role of Azure Role-Based Access Control (RBAC).
Azure RBAC manages user authorization by defining who (users, groups, service principals) can perform what actions (read, write, delete) on Azure resources.
Since the requirement is to restrict a specific user's delete action, Azure RBAC (such as assigning the Reader role or a custom role lacking delete permissions) must be used.

Key Concept

Azure Role-Based Access Control (RBAC) manages user authorization, whereas Azure Policy manages resource properties and compliance.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic