Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization organizes its cloud resources using the following Azure hierarchy:
* Management Group: MG-Corporate
* Subscription: Sub-FinApp
* Resource Group: RG-BillingData

A developer named Casey must be able to deploy and manage virtual machines and storage accounts within RG-BillingData. Additionally, Casey requires the ability to read, write, and delete blobs inside the storage accounts in RG-BillingData. Casey must not have permissions to assign RBAC roles to other users or manage resource locks.

Which role assignment configuration meets these requirements while adhering to the principle of least privilege?

  1. Assign the Contributor role and the Storage Blob Data Contributor role to Casey at the RG-BillingData scope.Cevap
  2. B
    Assign the Contributor role to Casey at the RG-BillingData scope.
  3. C
    Assign the Contributor role to Casey at the Sub-FinApp scope, and assign the Reader role to Casey at the RG-BillingData scope.
  4. D
    Assign the Contributor role and the Global Administrator role to Casey at the RG-BillingData scope.

Cevap

Assign the Contributor role and the Storage Blob Data Contributor role to Casey at the RG-BillingData scope.
The correct configuration is to assign both the Contributor role and the Storage Blob Data Contributor role to the developer at the resource group scope. The Contributor role provides control plane access to manage the lifecycle of virtual machines and storage accounts, but lacks data plane permissions to read or write blobs. Adding the Storage Blob Data Contributor role provides the required blob-level data access. Neither role allows managing role assignments or locks, preserving the principle of least privilege.

Adım Adım Çözüm

1
Analyze the control plane requirements.
Casey needs to deploy and manage virtual machines and storage accounts. The built-in Contributor role at the resource group scope (RG-BillingData) provides these capabilities without granting role assignment or lock management permissions.
Contributor allows full management of resources but does not allow authorization actions like assigning roles.
2
Analyze the data plane requirements.
Casey needs to read, write, and delete blobs inside the storage accounts. Since control plane roles like Contributor do not grant data plane access to blobs, a data plane role such as Storage Blob Data Contributor must be assigned.
Azure separation of concerns requires distinct roles for control plane (Contributor) and data plane (Storage Blob Data Contributor).
3
Evaluate role inheritance and scope restriction.
Assigning Contributor at the subscription scope and Reader at the resource group scope does not restrict access because RBAC permissions are inherited and additive; they cannot be restricted by a lower-level assignment.
Azure RBAC does not support explicit deny assignments through standard role assignments.
4
Distinguish between Azure RBAC and Microsoft Entra ID roles.
Global Administrator is a Microsoft Entra ID role that cannot be scoped to a resource group and is inappropriate for resource-level management.
Microsoft Entra ID roles manage directory tenant-level identity objects, whereas Azure RBAC roles manage Azure resources.

Anahtar Kavram

Azure RBAC separation of control plane and data plane permissions, role inheritance, and the distinction between Entra ID and RBAC roles.
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru