Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An administrator assigns User1 the Reader role at the subscription scope. Within this subscription, there is a resource group named Dev-RG. The administrator assigns User2 the Contributor role at the scope of Dev-RG. Which of the following statements about their inherited permissions are correct? (Select TWO)

  1. User1 can view all resources within the subscription, including those inside Dev-RG.Answer
  2. User2 can create and delete resources within Dev-RG, but cannot grant other users access to the resource group.Answer
  3. C
    User2 can create nested resource groups inside Dev-RG to organize resources.
  4. D
    User1 can enforce a rule that blocks the deployment of virtual machines of specific sizes within Dev-RG.

Answer

The correct statements are that User1 can view all resources within the subscription, and User2 can manage resources within Dev-RG without being able to grant access to others.
The correct statements are that the user with the Reader role at the subscription scope can view all resources in the subscription, and the user with the Contributor role at the resource group scope can create and delete resources within that resource group. Reader permissions inherit downwards from the subscription to all resource groups. The Contributor role grants full resource management rights but does not permit role assignments.

Step-by-Step Solution

1
Evaluate the permissions and scope of User1.
User1 is assigned the Reader role at the subscription level. Due to hierarchical inheritance, this permission flows down to all resource groups (like Dev-RG) and resources within the subscription, permitting read-only access to all of them.
To determine what resources User1 can access and what actions they can perform.
2
Evaluate the permissions and scope of User2.
User2 is assigned the Contributor role at the Dev-RG resource group level. This allows User2 to create, manage, and delete resources within Dev-RG, but they cannot assign permissions to others because the Contributor role lacks authorization write privileges.
To determine the capabilities of User2 within their assigned resource group scope.
3
Evaluate the incorrect options regarding nesting and policy enforcement.
Azure does not support nesting resource groups, so nested group creation is invalid. Enforcing configuration compliance is managed by Azure Policy rather than Azure RBAC.
To rule out the distractors by identifying resource group hierarchy limits and the boundary between RBAC and Azure Policy.

Key Concept

Azure Role-Based Access Control (RBAC) inheritance and scope boundaries, and its distinction from Azure Policy.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic