Examkin

Soru

Zorluk: OrtaAzure Role Assignments and Scopes

An organization has an Azure subscription named Sub1 that contains two resource groups named RG-Admin and RG-Finance. A user named User1 is currently assigned the Owner role at the Sub1 scope. You need to prevent User1 from modifying resources in RG-Finance, while allowing them to manage resources in RG-Admin. The solution must minimize administrative effort and follow the principle of least privilege. Which two actions should you perform? (Choose two.)

  1. Remove the Owner role assignment for User1 at the Sub1 scope.Cevap
  2. Assign the Contributor role to User1 at the RG-Admin scope.Cevap
  3. C
    Assign the Reader role to User1 at the RG-Finance scope.
  4. D
    Assign the Global Administrator role to User1 in Microsoft Entra ID.
  5. E
    Create an Administrative Unit containing RG-Finance and assign User1 the Reader role at that scope.

Cevap

Remove the Owner role assignment for User1 at the Sub1 scope, and assign the Contributor role to User1 at the RG-Admin scope.
To satisfy the requirements, you must first remove the Owner role assignment at the subscription scope. Because Azure RBAC roles are additive, inherited permissions cannot be overridden or denied by assigning a less permissive role at a lower scope. Once the inherited role is removed, assigning the Contributor role at the RG-Admin scope allows the user to manage resources in that resource group without having access to RG-Finance, thereby adhering to the principle of least privilege.

Adım Adım Çözüm

1
Analyze the current role assignments and inherited permissions.
User1 currently inherits Owner permissions on both RG-Admin and RG-Finance from the assignment at the Sub1 subscription scope.
Understanding scope hierarchy and inheritance is necessary to identify how permissions are being applied.
2
Remove the subscription-level Owner assignment.
User1 no longer inherits Owner permissions to any resources within Sub1.
Since Azure RBAC permissions are additive, inherited permissions cannot be blocked or denied at a lower scope. The assignment at the parent scope must be removed.
3
Apply target permissions using the principle of least privilege.
User1 is assigned the Contributor role at the RG-Admin scope, which allows them to manage resources in RG-Admin without accessing RG-Finance.
Assigning the Contributor role at the resource group scope provides management capabilities restricted to that specific scope, fulfilling the requirement.

Anahtar Kavram

Azure RBAC role assignments are additive, and inherited permissions cannot be restricted or blocked at a lower scope level.
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru