Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC)

An organization assigns a newly hired auditor the built-in Reader role at the subscription scope. The auditor needs to verify access and compliance settings across all resource groups. Which of the following capabilities will the auditor have? (Select two.)

  1. View the configurations of all virtual machines and storage accounts in the subscription.Answer
  2. View which users, groups, and service principals have access permissions assigned to resources.Answer
  3. C
    Enforce a restriction that prevents users from deploying virtual machines in unauthorized regions.
  4. D
    Assign the Reader role to other team members who join the audit project.

Answer

The auditor can view the configurations of all virtual machines and storage accounts in the subscription, and they can view which users, groups, and service principals have access permissions assigned to resources.
The built-in Reader role allows users to view all resources within the scope of the assignment and read their properties, configurations, and the access control settings (IAM) showing who has role assignments on those resources.

Step-by-Step Solution

1
Analyze the built-in Azure Reader role capabilities.
The Reader role grants read-only access to resources and access control lists (IAM) but does not grant modification permissions or access management capabilities.
This establishes what the Reader role is allowed to do at the assigned scope.
2
Determine if viewing configurations and permissions falls under the Reader role's capabilities.
Viewing virtual machine/storage configurations and viewing role assignments are both read-only actions, so they are allowed.
This identifies the correct capabilities for the scenario.
3
Evaluate the other options against Azure administration concepts.
Restricting deployment regions is an Azure Policy function, and assigning roles to others requires Owner or User Access Administrator permissions, which are not included in the Reader role.
This rules out the incorrect options.

Key Concept

Azure Role-Based Access Control (RBAC)
Estimated Time:1m 30s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic