Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An administrator needs to grant a user named Pat the ability to manage all resources within a resource group named RG-Compute, including the ability to assign permissions to other users. The administrator also wants to ensure that all resources deployed within RG-Compute comply with a corporate rule that restricts deployments to the 'West US' region.

Which combination of Azure features should the administrator use to meet these requirements?

  1. Assign Pat the Owner role for RG-Compute, and assign an Azure Policy to RG-Compute to restrict the deployment region.Answer
  2. B
    Assign Pat the Contributor role for RG-Compute, and assign an Azure Policy to RG-Compute to manage user role assignments.
  3. C
    Assign Pat the User Access Administrator role for RG-Compute, and use Azure RBAC to restrict resource deployments to the 'West US' region.
  4. D
    Assign Pat the Owner role for RG-Compute, and use Azure RBAC role assignments to restrict the resource deployment regions.

Answer

Assign Pat the Owner role for RG-Compute, and assign an Azure Policy to RG-Compute to restrict the deployment region.
Assigning Pat the Owner role for the resource group provides the necessary permissions to manage resources and delegate access control to others. Since Azure RBAC cannot enforce resource property restrictions, an Azure Policy must be applied to the resource group to restrict resource deployments to the 'West US' region.

Step-by-Step Solution

1
Analyze the access control requirements for Pat.
Pat requires full resource management capabilities and the ability to assign permissions to others.
This determines which Azure RBAC role needs to be assigned.
2
Evaluate the built-in RBAC roles for the resource group scope.
The Owner role provides full resource management and role delegation capabilities. The Contributor role lacks role delegation, and the User Access Administrator role lacks resource management.
Only the Owner role satisfies all access control requirements.
3
Analyze the resource compliance requirement.
Resources must be restricted to the 'West US' region.
This determines which Azure governance feature should be applied.
4
Select the governance tool for resource property enforcement.
Azure Policy is designed to enforce resource properties (like location compliance). Azure RBAC controls access and cannot enforce resource properties.
Azure Policy must be used to restrict resource deployment regions.

Key Concept

Understanding the difference between Azure RBAC (identity-based access management) and Azure Policy (resource property compliance and enforcement), and how scopes and built-in roles inherit permissions.
Estimated Time:1m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic