Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

A security administrator needs to ensure that a database auditor can view the configuration of all resources inside a resource group named Billing-RG, but cannot modify any settings, delete resources, or grant other users access to the resource group. Which configuration should the administrator implement?

  1. Assign the Reader role to the user at the Billing-RG scope.Answer
  2. B
    Assign the Contributor role to the user at the Billing-RG scope, and apply an Azure Policy that denies delete actions.
  3. C
    Assign the User Access Administrator role to the user at the Billing-RG scope.
  4. D
    Assign the Owner role to the user at the Billing-RG scope, and apply a ReadOnly resource lock to Billing-RG.

Answer

Assign the Reader role to the user at the Billing-RG scope.
Assigning the Reader role at the Billing-RG scope is the correct solution because it grants the user permission to view all resources in the resource group, but strictly prevents them from making any modifications, deleting resources, or delegating access permissions to others.

Step-by-Step Solution

1
Identify the required level of access for the database auditor.
The auditor requires read-only access (viewing configurations) without the ability to modify settings, delete resources, or manage user access permissions.
This establishes the baseline requirements to select the correct Azure Role-Based Access Control (RBAC) role.
2
Evaluate the built-in Azure RBAC roles against the requirements.
The Reader role grants read-only access, the Contributor role allows resource modification, and the Owner role allows full management and access delegation. The User Access Administrator role only manages user access.
Matching the requirements to the correct built-in role ensures least privilege is applied.
3
Determine the appropriate scope for the assignment.
Assigning the Reader role at the Billing-RG scope restricts access specifically to that resource group.
Assigning roles at the correct scope ensures the user only has access to the target resources.

Key Concept

Azure Role-Based Access Control (RBAC) is used to manage who has access to Azure resources, what they can do with those resources, and what areas they have access to.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic