Examkin

Soru

Zorluk: OrtaAzure Role Assignments and Scopes

An organization is configuring access control for its Azure environment. You have the following Azure resource hierarchy and assignments:

* Subscription1
* ResourceGroup1
* StorageAccount1 (contains a blob container named container1)
* ResourceGroup2
* VM1 (Virtual Machine)

You configure the following identity and access management settings:
- User1 is assigned the Microsoft Entra ID Global Administrator role.
- User1 is assigned the Storage Blob Data Reader role at the scope of Subscription1.
- User1 is assigned the Reader role at the scope of ResourceGroup2.

Which of the following actions can User1 perform? (Select two.)

  1. Read blob data inside container1.Cevap
  2. View the configuration settings of VM1.Cevap
  3. C
    Create a new resource group in Subscription1.
  4. D
    Configure a deny assignment on ResourceGroup1 to block the inherited Storage Blob Data Reader role.

Cevap

User1 can read blob data inside container1 and view the configuration settings of VM1.
The correct actions are reading blob data inside container1 and viewing the configuration settings of VM1. The Storage Blob Data Reader role at the subscription level inherits down to the container level, granting the necessary data plane read permissions. Similarly, the Reader role at the resource group level inherits to VM1, allowing the user to view VM1's configuration details.

Adım Adım Çözüm

1
Evaluate the permissions inherited from the subscription scope to the storage data plane.
The Storage Blob Data Reader role assigned at Subscription1 inherits down to all storage accounts and blob containers under it. This allows reading blob data inside container1.
Azure RBAC assignments at a higher scope (Subscription1) automatically flow down to child resources (ResourceGroup1 -> StorageAccount1 -> container1).
2
Evaluate the permissions inherited from the resource group scope to the virtual machine.
The Reader role assigned at ResourceGroup2 inherits to VM1, allowing the user to view VM1's configuration settings.
RBAC inheritance applies to resource group level assignments, flowing down to all child resources within that resource group.
3
Analyze the Microsoft Entra ID Global Administrator role's effect on subscription resources.
The Global Administrator role does not grant permissions to create resource groups in Subscription1.
Microsoft Entra ID roles (like Global Administrator) and Azure RBAC roles are separate. Entra ID roles manage directory resources, while RBAC roles manage Azure subscription resources.
4
Evaluate if inheritance can be blocked using deny assignments.
It is not possible to manually configure a deny assignment to block the inherited Storage Blob Data Reader role.
Azure RBAC is additive, and standard administrators cannot create manual deny assignments.

Anahtar Kavram

Azure RBAC roles are additive and inherit down the resource hierarchy. Microsoft Entra ID roles do not automatically grant permissions to subscription resources, and standard administrators cannot create manual deny assignments.
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru