Examkin

Question

Difficulty: HardAzure Role-Based Access Control (RBAC)

An enterprise administrator is designing a governance and access strategy for a newly created Azure subscription. The strategy must satisfy two requirements:

1. A security compliance team must be able to view all resource configurations and inspect active role assignments, but they must not be allowed to modify resources or alter permissions.
2. A development team must be permitted to create and manage virtual machines within a resource group named RG-Web, but they must be prevented from deploying any virtual machines that lack a 'Department' tag.

Which solution should the administrator implement?

  1. A
    Assign the Reader role to the security compliance team at the subscription scope; assign the Contributor role to the development team at the resource group scope; and configure a custom Azure RBAC role that blocks the deployment of virtual machines without the 'Department' tag.
  2. B
    Assign the User Access Administrator role to the security compliance team at the subscription scope; assign the User Access Administrator role to the development team at the resource group scope; and assign an Azure Policy that requires the 'Department' tag on virtual machines.
  3. Assign the Reader role to the security compliance team at the subscription scope; assign the Virtual Machine Contributor role to the development team at the resource group scope; and assign an Azure Policy that requires the 'Department' tag on virtual machines.Answer
  4. D
    Assign the Owner role to the security compliance team at the resource group scope; assign the Reader role to the development team at the resource group scope; and apply a ReadOnly resource lock to enforce the 'Department' tag.

Answer

Assign the Reader role to the security compliance team at the subscription scope; assign the Virtual Machine Contributor role to the development team at the resource group scope; and assign an Azure Policy that requires the 'Department' tag on virtual machines.
The correct solution uses the Reader role to grant the security compliance team read-only access to resource configurations and permissions at the subscription level. It uses the Virtual Machine Contributor role to grant the development team the ability to manage virtual machines within the specific resource group (RG-Web). Finally, it uses Azure Policy to enforce the presence of the 'Department' tag on virtual machines, separating access control from resource compliance.

Step-by-Step Solution

1
Analyze the access requirement for the security compliance team.
The team must view resource settings and role assignments but cannot modify them or change permissions. The built-in Reader role provides read-only access to resources and permissions at the assigned scope.
Choosing the Reader role prevents unauthorized modifications or permission alterations while satisfying the auditing requirement.
2
Analyze the resource management requirement for the development team.
The team needs to create and manage virtual machines inside a specific resource group (RG-Web). The built-in Virtual Machine Contributor role allows managing virtual machines without granting access to the underlying virtual network or storage account, or the ability to manage permissions.
Using a scoped role like Virtual Machine Contributor at the resource group level ensures the principle of least privilege is followed.
3
Analyze the governance requirement to block virtual machines without a specific tag.
Enforcing resource properties or compliance rules (like requiring a 'Department' tag) must be done using Azure Policy.
Azure RBAC manages identity-based access, whereas Azure Policy controls the properties of the resources being deployed.

Key Concept

Azure RBAC roles (Reader, Virtual Machine Contributor) manage access permissions based on identities and scope, while Azure Policy enforces compliance and resource properties.
Estimated Time:2m 0s
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic