Examkin

Soru

Zorluk: ZorAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization has the following Azure resource hierarchy:
* Tenant Root Group (Management Group)
* MG-Platform (Management Group)
* Sub-Connectivity (Subscription)
* RG-HubNet (Resource Group)
* MG-Apps (Management Group)
* Sub-App01 (Subscription)
* RG-AppLogic (Resource Group)
* RG-AppData (Resource Group)

You have a security group named DatabaseOps-SG. The members of this group must be able to perform the following tasks:
* Manage Azure SQL servers and databases within RG-AppData.
* Read and write database backup blobs directly in a storage account located in RG-AppData.
* View virtual networks and subnet configurations within RG-HubNet to assist with database private endpoint configuration.

The solution must follow the principle of least privilege.

Which three role assignments should you configure? (Select three).

  1. Assign SQL Server Contributor to DatabaseOps-SG at the RG-AppData scopeCevap
  2. Assign Storage Blob Data Contributor to DatabaseOps-SG at the RG-AppData scopeCevap
  3. Assign Reader to DatabaseOps-SG at the RG-HubNet scopeCevap
  4. D
    Assign Contributor to DatabaseOps-SG at the Sub-App01 scope
  5. E
    Assign Application Administrator in Microsoft Entra ID to DatabaseOps-SG
  6. F
    Assign Owner to DatabaseOps-SG at the Tenant Root Group scope, and configure a Deny assignment at the Sub-App01 scope

Cevap

Assign SQL Server Contributor at the RG-AppData scope, Storage Blob Data Contributor at the RG-AppData scope, and Reader at the RG-HubNet scope.
The correct role assignments are SQL Server Contributor at the RG-AppData scope, Storage Blob Data Contributor at the RG-AppData scope, and Reader at the RG-HubNet scope. The SQL Server Contributor role allows managing SQL servers and databases within the specific resource group without subscription-wide access. The Storage Blob Data Contributor role is required because standard control-plane roles (such as Contributor) do not grant permissions to read and write blobs directly. Assigning the Reader role at the RG-HubNet scope allows viewing the network infrastructure required to set up private endpoints without granting permissions to modify the network.

Adım Adım Çözüm

1
Identify the required control plane roles for SQL Database management.
SQL Server Contributor at the RG-AppData scope.
This role allows database and server management at the minimum required resource group scope.
2
Identify the required data plane roles for Blob Storage access.
Storage Blob Data Contributor at the RG-AppData scope.
Control plane roles do not grant access to Blob data, so a data plane role is required.
3
Identify the required permissions for viewing network configurations.
Reader at the RG-HubNet scope.
This permits viewing the virtual network configurations in the connectivity subscription without modify permissions.

Anahtar Kavram

Azure RBAC utilizes separate roles for control plane and data plane operations and enforces scope inheritance down the resource hierarchy.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru