Examkin

Soru

Zorluk: OrtaAzure Role Assignments and Scopes

An organization's Azure environment is structured with the following resource hierarchy:
- Management Group: `MG-Production`
- Subscription: `Sub-Production`
- Resource Group: `RG-App-Services`

A user named Admin1 is assigned the Global Administrator directory role in Microsoft Entra ID. Admin1 logs into the Azure portal but is unable to view the resources within `RG-App-Services` or the subscription itself. What should you do to allow Admin1 to view the web apps inside `RG-App-Services`?

  1. Assign Admin1 the Reader Azure RBAC role at the `Sub-Production` subscription scope.Cevap
  2. B
    Configure Admin1's Global Administrator role to target the `RG-App-Services` resource group as an Administrative Unit scope.
  3. C
    Rely on directory role inheritance, as the Global Administrator role automatically grants Owner rights to all subscriptions under the tenant root.
  4. D
    Assign Admin1 the Reader Azure RBAC role at the `MG-Production` scope and create an explicit RBAC deny assignment at the subscription scope.

Cevap

Assign Admin1 the Reader Azure RBAC role at the `Sub-Production` subscription scope.
Assigning the Reader role at the subscription scope ensures that the read permission inherits down through the resource hierarchy to the resource group and individual resources. Because Entra ID directory roles do not automatically grant permissions to manage subscription resources, an explicit Azure RBAC assignment is necessary.

Adım Adım Çözüm

1
Identify the relationship between Entra ID roles and Azure RBAC roles.
Confirm that the Global Administrator directory role does not automatically grant permissions to Azure subscription resources.
Entra ID and Azure RBAC have separate authorization control planes.
2
Evaluate the target scope and minimum permissions required to fulfill the request.
The requirement is to view the web apps inside the `RG-App-Services` resource group.
Choosing the correct built-in role (Reader) and the proper scope (subscription or resource group) is necessary to grant the access.
3
Determine the proper assignment scope that will propagate down to the resources.
Assigning the Reader role at the `Sub-Production` subscription scope will propagate via inheritance down to the `RG-App-Services` resource group and the web apps inside it.
Azure RBAC utilizes a hierarchical inheritance model where permissions applied at a parent scope flow down to all child scopes.

Anahtar Kavram

Azure RBAC role assignment scopes and role inheritance, specifically the separation between Microsoft Entra ID roles and Azure RBAC roles.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru