Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An administrator is configuring access control and compliance for an Azure resource group named 'Dev-RG'. A team of developers must be able to create, delete, and modify virtual machines within 'Dev-RG', but they must not be able to delegate access permissions to other users. Additionally, the organization wants to ensure that all virtual machines in 'Dev-RG' are deployed only in the East US region.

Which configuration should the administrator use to meet these requirements?

  1. Assign the Contributor role to the developers at the 'Dev-RG' scope, and assign an Azure Policy definition to 'Dev-RG'.Answer
  2. B
    Assign the Contributor role to the developers at the 'Dev-RG' scope, and configure a custom Azure role-based access control (RBAC) role to enforce the allowed regions.
  3. C
    Assign the Owner role to the developers at the 'Dev-RG' scope, and assign an Azure Policy definition to 'Dev-RG'.
  4. D
    Assign the Contributor role to the developers at the 'Dev-RG' scope, and apply a ReadOnly resource lock to 'Dev-RG'.

Answer

Assign the Contributor role to the developers at the 'Dev-RG' scope, and assign an Azure Policy definition to 'Dev-RG'.
The combination of assigning the Contributor role at the resource group scope and applying an Azure Policy definition correctly satisfies the requirements. The Contributor role grants full access to manage resources within the resource group but does not allow assigning roles to other users. Azure Policy is designed to enforce resource compliance rules, such as restricting deployments to a specific region.

Step-by-Step Solution

1
Determine the correct Azure RBAC role to allow resource creation and management without delegation capabilities.
The Contributor role allows managing all resources but cannot assign roles in Azure RBAC, which satisfies the restriction on access delegation.
The Owner role allows role delegation, which is forbidden by the scenario, while the Reader role only allows viewing resources.
2
Determine the correct feature to enforce compliance rules (such as location/region restrictions).
Azure Policy is the service used to enforce rules and compliance constraints on resource properties.
Azure RBAC manages user permissions (who can do what), not resource compliance properties (what rules resources must follow).
3
Combine the RBAC assignment and policy definition to satisfy both requirements.
Assigning the Contributor role to the developer team at the resource group scope and assigning an Azure Policy definition restricting deployment to East US meets all specified requirements.
Combining Contributor (for permissions) and Azure Policy (for compliance) solves both administrative needs.

Key Concept

Azure Role-Based Access Control (RBAC) manages access permissions, while Azure Policy enforces resource property compliance.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic