Examkin

Soru

Zorluk: KolayAzure Role-Based Access Control (RBAC) Configuration and Roles

An administrator is configuring access control for an Azure environment where the Prod-MG management group contains the Sub1 subscription, which in turn contains the Data-RG resource group. A storage account named storage1 is deployed in Data-RG. A developer needs to upload and read blobs in storage1. The developer must not have permissions to modify the configuration of the storage account or any other resources in the subscription. Which built-in role and scope should the administrator assign to the developer to meet these requirements while adhering to the principle of least privilege?

  1. Storage Blob Data Contributor assigned at the storage1 scopeCevap
  2. B
    Storage Account Contributor assigned at the Data-RG scope
  3. C
    User Administrator assigned at the Prod-MG scope
  4. D
    Reader assigned at the Sub1 scope

Cevap

Assign the Storage Blob Data Contributor role at the storage1 scope.
Assigning the Storage Blob Data Contributor role at the storage1 scope is correct because it grants the specific data plane permissions required to upload and read blobs on that specific storage account, satisfying the principle of least privilege without providing management access to other resources.

Adım Adım Çözüm

1
Analyze the required permissions for the developer.
The developer needs data plane access (upload and read blobs) but must not have administrative privileges to modify resource configurations.
This identifies that a data plane role like Storage Blob Data Contributor is needed, rather than a control plane role like Storage Account Contributor.
2
Determine the correct scope following the principle of least privilege.
The scope should be restricted to the specific storage account (storage1) rather than the resource group (Data-RG) or subscription (Sub1).
Assigning permissions at the resource level restricts access to only what is necessary, preventing access to other resources.
3
Select the appropriate Azure RBAC role and scope combination.
Assign Storage Blob Data Contributor at the storage1 scope.
This satisfies both the data access requirement and the least privilege constraint.

Anahtar Kavram

Azure RBAC roles distinguish between control plane and data plane operations, and scopes define the boundary of these permissions.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru