Examkin

Question

Difficulty: Very hardAzure Role-Based Access Control (RBAC)

An enterprise manages its resources using an Azure Management Group named Group-Main. Inside Group-Main, there is a subscription named Sub-Prod, which contains a resource group named RG-App. RG-App contains a virtual machine named VM-Web. You need to configure access for an auditor named Auditor1 to meet the following requirements:
1. Auditor1 must be able to view the configuration of all existing and future resources across all subscriptions under Group-Main.
2. Auditor1 must be able to assign and revoke RBAC roles for VM-Web only.
3. Auditor1 must not be able to modify the resource configuration or delete VM-Web.
4. The solution must minimize administrative effort and follow the principle of least privilege.

Which configuration should you implement?

  1. Assign the Reader role to Auditor1 at the Group-Main scope, and assign the User Access Administrator role to Auditor1 at the VM-Web scope.Answer
  2. B
    Assign the Reader role to Auditor1 at the Group-Main scope, and assign the Owner role to Auditor1 at the VM-Web scope.
  3. C
    Assign the Reader role to Auditor1 at the Group-Main scope, and use Azure Policy to assign role delegation permissions for VM-Web to Auditor1.
  4. D
    Assign the User Access Administrator role to Auditor1 at the Group-Main scope, and assign the Reader role to Auditor1 at the RG-App scope.

Answer

Assign the Reader role to Auditor1 at the Group-Main scope, and assign the User Access Administrator role to Auditor1 at the VM-Web scope.
Assigning the Reader role at the Management Group level ensures the auditor can view all current and future resources across all subscriptions due to inheritance. Assigning the User Access Administrator role at the virtual machine level grants the ability to manage role assignments on that specific resource without providing permissions to modify or delete the resource itself.

Step-by-Step Solution

1
Analyze the viewing requirement for all resources under the Management Group.
Assign the Reader role at the Group-Main management group scope. This ensures access is inherited by all subscriptions, resource groups, and resources underneath.
Azure RBAC permissions propagate down the management hierarchy through inheritance.
2
Analyze the permission management requirement for the specific virtual machine.
Assign the User Access Administrator role at the VM-Web resource scope.
This role allows the user to manage role assignments (grant/revoke access) for VM-Web without granting administrative control over the resource itself.
3
Apply the principle of least privilege and verify restrictions.
Ensure the Auditor1 does not receive Owner or Contributor roles at scopes higher than VM-Web, preventing unauthorized configuration changes or deletion of VM-Web.
The Owner role at any scope covering VM-Web would allow deletion and configuration modifications, which violates the security constraints.

Key Concept

Azure Role-Based Access Control (RBAC) scopes and role inheritance
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic