Examkin

Question

Difficulty: HardAzure Role-Based Access Control (RBAC)

An organization's Azure hierarchy includes a management group named Corp-MG, a subscription named Sales-Sub inside Corp-MG, and a resource group named App-RG inside Sales-Sub. An administrator must implement the following security requirements:

1. Members of a group named Audit-Team must be able to view all resources in Corp-MG, Sales-Sub, and App-RG, but must not be allowed to modify or create any resources outside of App-RG.
2. Members of Audit-Team must also be able to create, start, and delete virtual machines, but only within App-RG.
3. To enforce compliance, no virtual machines deployed within Sales-Sub are permitted to have public IP addresses.

To meet these requirements using the principle of least privilege and native Azure capabilities, which combination of role assignments and governance tools should the administrator configure?

  1. Assign the Reader role to Audit-Team at the Corp-MG scope, assign the Contributor role to Audit-Team at the App-RG scope, and assign an Azure Policy definition to Sales-Sub that denies virtual machines with public IP addresses.Answer
  2. B
    Assign the Reader role to Audit-Team at the Corp-MG scope, assign the Contributor role to Audit-Team at the App-RG scope, and create a custom Azure RBAC role at the Sales-Sub scope that denies virtual machine deployments containing public IP addresses.
  3. C
    Assign the Reader role to Audit-Team at the Corp-MG scope, assign the Reader role to Audit-Team at the Sales-Sub scope, and assign an Azure Policy definition to App-RG that denies virtual machines with public IP addresses.
  4. D
    Assign the Contributor role to Audit-Team at the Corp-MG scope, assign the Reader role to Audit-Team at the App-RG scope, and assign an Azure Policy definition to Sales-Sub that denies virtual machines with public IP addresses.

Answer

Assign the Reader role to Audit-Team at the Corp-MG scope, assign the Contributor role to Audit-Team at the App-RG scope, and assign an Azure Policy definition to Sales-Sub that denies virtual machines with public IP addresses.
The correct configuration assigns the Reader role at the highest required scope (Corp-MG), allowing Audit-Team to view all resources across the entire management group hierarchy due to inheritance. Assigning the Contributor role at the lower resource group scope (App-RG) grants the group permission to create and manage virtual machines within that specific resource group. Since Azure RBAC permissions are additive, the Contributor role at App-RG overrides the inherited Reader role for resources within that group. Enforcing properties on resources, such as preventing virtual machines from having public IP addresses, is the responsibility of Azure Policy rather than Azure RBAC. Applying the Azure Policy definition at the Sales-Sub scope ensures that no resource groups or resources within the subscription can bypass this rule.

Step-by-Step Solution

1
Determine the scope and role required for read-only access across the entire hierarchy.
Assign the Reader role at the Corp-MG scope.
Since Azure RBAC permissions are inherited by descendant scopes, assigning Reader at the management group level automatically grants view-only access to all underlying subscriptions, resource groups, and resources.
2
Determine how to grant VM management permissions exclusively within the target resource group.
Assign the Contributor role at the App-RG scope.
Azure RBAC permissions are cumulative (additive). Assigning Contributor at the App-RG scope adds the write, delete, and deploy permissions required for virtual machines inside that resource group, overriding the inherited Reader role for those specific resources without elevating privileges elsewhere.
3
Determine how to enforce compliance rules blocking public IPs on virtual machines.
Assign an Azure Policy definition that denies public IPs at the Sales-Sub scope.
Azure RBAC governs identity access (who has permissions), while Azure Policy governs resource properties (compliance and constraints). Restricting VM configurations like public IP addresses requires Azure Policy.

Key Concept

Azure RBAC scopes, roles, inheritance rules, additive permissions, and distinguishing them from Azure Policy constraints.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic