Examkin

Soru

Zorluk: KolayAzure Role Assignments and Scopes

Your company has an Azure environment with the following hierarchy:

* Management Group: MG-Compliance
* Subscription: Sub-Audit
* Resource Group: RG-Security
* Key Vault: kv-secrets

User1 is assigned the Contributor role at the MG-Compliance scope.
User2 is assigned the Reader role at the Sub-Audit scope.

Which two statements correctly describe the inherited permissions of User1 and User2 on kv-secrets? (Select two.)

  1. User1 inherits Contributor permissions on kv-secrets because role assignments at a parent management group scope inherit down to all child scopes.Cevap
  2. User2 inherits Reader permissions on kv-secrets because role assignments at the subscription scope inherit down to all child resource groups and resources.Cevap
  3. C
    User1 has no permissions on kv-secrets because role assignments at the management group level do not inherit to resources inside a resource group.
  4. D
    User2 is automatically granted Owner permissions on kv-secrets if User2 is also a Global Administrator in Microsoft Entra ID.

Cevap

User1 inherits Contributor permissions on kv-secrets due to downward inheritance from the management group scope, and User2 inherits Reader permissions on kv-secrets due to inheritance from the subscription scope.
The correct statements are that the Contributor role assigned to the first user at the management group scope inherits all the way down to the Key Vault, and the Reader role assigned to the second user at the subscription scope also inherits down to the Key Vault. This is because Azure RBAC uses a strict hierarchical inheritance model where permissions propagate downward from parent scopes to child resources.

Adım Adım Çözüm

1
Analyze the resource hierarchy and the scope of each role assignment.
User1 has Contributor assigned at the MG-Compliance management group level. User2 has Reader assigned at the Sub-Audit subscription level. The Key Vault kv-secrets resides within resource group RG-Security, which is inside Sub-Audit, which is inside MG-Compliance.
Understanding the containment relationship in the Azure resource hierarchy is essential for evaluating RBAC inheritance.
2
Apply Azure RBAC inheritance rules downward through the scope hierarchy.
The Contributor role assigned at the management group scope inherits down to the subscription, resource group, and finally the Key Vault resource. The Reader role assigned at the subscription scope inherits down to the resource group and the Key Vault resource.
Azure RBAC roles are inherited by child resources from their parent scopes, unless blocked or overridden by more specific roles or Deny assignments.
3
Determine the effective permissions for User1 and User2 on kv-secrets and rule out incorrect directory-level assumptions.
User1 holds effective Contributor permissions, and User2 holds effective Reader permissions. Entra ID Global Administrator roles do not automatically elevate permissions to Azure resources.
Inherited permissions are applied additively. Microsoft Entra ID directory administration roles do not directly grant data plane or control plane permissions on subscriptions without explicit assignment or directory settings configuration.

Anahtar Kavram

Azure RBAC inheritance and scope hierarchy
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru