Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC)

An administrator wants to ensure that a newly hired auditor can view all configurations of the Azure resources within a resource group named 'Finance-RG', but cannot make any modifications to them. Which configuration should the administrator use to meet this requirement?

  1. Assign the Reader role to the auditor at the resource group scope.Answer
  2. B
    Create an Azure Policy that denies write actions specifically for the auditor's user account.
  3. C
    Apply a ReadOnly resource lock to the resource group that targets only the auditor's user account.
  4. D
    Add a metadata resource tag to the resource group that specifies read-only access for the auditor.

Answer

Assign the Reader role to the auditor at the resource group scope.
Assigning the Reader role to the auditor at the resource group scope is correct because the built-in Reader role grants read-only access to all resources within the assigned scope. Because RBAC permissions are inherited by all child resources, assigning this role at the resource group level ensures the auditor can view all resources in the group without being able to modify them.

Step-by-Step Solution

1
Identify the primary goal of the request.
The requirement is to grant a specific user (the auditor) read-only access (viewing configurations without editing) to a specific resource group.
This establishes the scope (resource group) and the permission level (read-only) required.
2
Evaluate the management tools available in Azure for managing user permissions.
Azure Role-Based Access Control (RBAC) is the correct tool for managing who has what access to Azure resources.
Other governance features like Azure Policy, resource locks, and tags serve different purposes (compliance, accidental deletion prevention, and organization, respectively).
3
Select the appropriate built-in Azure RBAC role and scope.
The Reader role is a built-in role designed specifically to allow viewing of resources without making changes. Assigning it at the resource group scope applies this permission to all resources within that group.
This matches the requirement of granting read-only access to a specific resource group.

Key Concept

Azure Role-Based Access Control (RBAC) is used to manage user access and permissions to Azure resources by assigning built-in or custom roles at specific scopes.
Rate this question

Topics

Azure Role-Based Access Control (RBAC)

More questions from this topic