Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC) Configuration and Roles

An administrator needs to configure permissions within the following Azure resource structure:
* Management Group: Tenant-Corporate-MG
* Subscription: Operations-Prod-Sub
* Resource Group: Ops-Data-RG
* Storage Account: opsdatafiles

A cloud engineer named Sam is a member of the Microsoft Entra ID Global Administrator role. Sam requires access to upload and read blobs within the containers of the opsdatafiles storage account using Microsoft Entra ID authentication. To comply with security policies, Sam must not be allowed to modify the configuration of the storage account itself, delete the storage account, or modify permissions for other users.

Which configuration represents the most secure method to grant Sam the required access while adhering to the principle of least privilege?

  1. A
    Enable the 'Access management for Azure resources' setting in the Microsoft Entra ID tenant properties for Sam's account.
  2. Assign Sam the Storage Blob Data Contributor role scoped to the opsdatafiles storage account.Cevap
  3. C
    Assign Sam the Contributor role scoped to the Ops-Data-RG resource group.
  4. D
    Assign Sam the Storage Blob Data Contributor role scoped to the Tenant-Corporate-MG management group.

Cevap

Assign Sam the Storage Blob Data Contributor role scoped to the opsdatafiles storage account.
Assigning the Storage Blob Data Contributor role scoped directly to the opsdatafiles storage account allows Sam to read, write, and delete blob data using Microsoft Entra ID authentication. Because it is scoped to the storage account rather than a higher level, and because the Storage Blob Data Contributor role does not grant management permissions over the storage account itself or role assignments, this fulfills all requirements under the principle of least privilege.

Adım Adım Çözüm

1
Differentiate between Microsoft Entra ID roles and Azure RBAC roles.
Recognize that Global Administrator is a Microsoft Entra ID directory role, which does not automatically grant access to Azure subscription data resources without explicit RBAC assignments.
This establishes that additional action is needed despite Sam holding directory-level Global Administrator status.
2
Distinguish between Azure RBAC control plane and data plane roles.
Identify that the Storage Blob Data Contributor role is required for data plane operations (reading/writing blobs), whereas the Contributor role only manages control plane operations (infrastructure settings).
This ensures Sam has the correct functional access to perform the required tasks without holding excessive management permissions.
3
Select the correct target scope to enforce the principle of least privilege.
Determine that scoping the role assignment directly to the opsdatafiles storage account resource is more secure than scoping it at the resource group, subscription, or management group levels.
This limits Sam's access exclusively to the target storage account and prevents inheritance from granting access to other resources.

Anahtar Kavram

Applying Azure RBAC roles at the appropriate scope to separate control plane and data plane access under the principle of least privilege.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru