Examkin

Soru

Zorluk: OrtaAzure Role Assignments and Scopes

Your organization has a Microsoft Entra ID tenant and an Azure resource hierarchy configured as follows:
* Management Group: `mg-logistics`
* Subscription: `sub-shipping`
* Resource Group: `rg-tracking`
* Storage Account: `stlogisticsapps`
* Virtual Machine: `vm-router`

You configure the following administrative assignments:
* User1: Assigned the Global Administrator directory role in Microsoft Entra ID with no direct Azure RBAC role assignments.
* User2: Assigned the Reader role at the subscription level (`sub-shipping`) and the Storage Blob Data Contributor role at the resource group level (`rg-tracking`).
* User3: Assigned the Contributor role at the management group level (`mg-logistics`).

You need to evaluate the effective permissions for the users within this hierarchy. Which of the following statements are correct? (Select two.)

  1. User3 can create new resource groups within the sub-shipping subscription.Cevap
  2. User2 can read blob data in the stlogisticsapps storage account using Microsoft Entra ID credentials.Cevap
  3. C
    User1 can immediately restart the vm-router virtual machine because they are a Microsoft Entra ID Global Administrator.
  4. D
    User3 can read blob data in the stlogisticsapps storage account using Microsoft Entra ID credentials.

Cevap

User3 can create new resource groups within the sub-shipping subscription, and User2 can read blob data in the stlogisticsapps storage account using Microsoft Entra ID credentials.
The correct statements are that User3 can create resource groups within the subscription and User2 can read storage blob data using Entra ID. User3 inherits Contributor permissions from the management group level, which includes resource group creation at the subscription level. User2 inherits the Storage Blob Data Contributor role from the resource group level to the storage account, enabling data plane access, while their subscription-level Reader role provides control plane visibility.

Adım Adım Çözüm

1
Evaluate the inheritance of control plane permissions for User3.
User3 inherits Contributor permissions at the subscription level from the management group.
Azure RBAC assignments at a higher scope (Management Group) inherit down to child scopes (Subscriptions, Resource Groups, and Resources).
2
Evaluate data plane and control plane access for User2.
User2 has Reader access at the subscription level (control plane) and Storage Blob Data Contributor access at the resource group level (data plane).
Data plane roles inherit down to child resources (Storage Account), allowing blob read/write operations via Entra ID credentials, while the control plane Reader role allows directory listing.
3
Evaluate the permissions of User1 (Global Administrator).
User1 has no direct permissions to manage subscription resources.
Microsoft Entra ID roles and Azure RBAC roles are separate. A Global Administrator must elevate access to manage Azure resources.
4
Evaluate data plane access for User3 (Contributor).
User3 has control plane access but no data plane access using Entra ID credentials.
Standard roles like Contributor or Owner do not grant data plane access for storage accounts when accessing blobs via Microsoft Entra ID authentication.

Anahtar Kavram

Azure RBAC inheritance down the resource hierarchy and the separation between Microsoft Entra ID roles, Azure control plane roles, and data plane roles.
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru