Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC)

An administrator needs to configure permissions for a junior auditor. The auditor must be able to view the configuration of all resources in an Azure resource group named RG-Analytics, but must not be allowed to create, modify, or delete any resources. Other administrators must still be able to fully manage and edit resources within RG-Analytics. Which configuration should the administrator apply to the junior auditor?

  1. Assign the Reader role to the junior auditor at the RG-Analytics scopeAnswer
  2. B
    Apply a ReadOnly resource lock to the RG-Analytics resource group
  3. C
    Assign the Contributor role and apply an Azure Policy that denies write actions to the junior auditor
  4. D
    Create an Azure Policy definition that blocks resource deletion and assign it to the junior auditor

Answer

Assign the Reader role to the junior auditor at the RG-Analytics scope
Assigning the Reader role to the junior auditor at the RG-Analytics scope allows the auditor to view all resources in the resource group but prevents them from making changes. It does not affect other administrators who have higher permissions (like Contributor or Owner) on the resource group.

Step-by-Step Solution

1
Identify the goal: allow a specific user to view resources but not modify them, while keeping other administrators' access intact.
Requires user-specific authorization control rather than a global resource restriction.
This determines that Azure Role-Based Access Control (RBAC) is the correct feature to use, rather than resource locks or Azure Policy.
2
Select the appropriate built-in Azure RBAC role that matches the read-only requirement.
The Reader role provides read-only access to resources at the specified scope.
The Reader role allows viewing resources but prevents any creation, modification, or deletion, satisfying the requirements without affecting other users.

Key Concept

Azure Role-Based Access Control (RBAC) allows administrators to assign specific permissions to users, groups, or service principals at different scopes (Management Groups, Subscriptions, Resource Groups, or Resources) using built-in roles like Reader, Contributor, and Owner.
Estimated Time:45s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic