Examkin

Soru

Zorluk: KolayAzure Role Assignments and Scopes

A compliance officer needs to inspect resource configurations. An administrator configures the following Azure resource hierarchy:

* Management Group: MG-Enterprise
* Subscription: Sub-Billing
* Resource Group: RG-Finance
* Virtual Machine: VM-Ledger

You assign the compliance officer the Reader role at the Sub-Billing subscription scope.

Which of the following describes the access the compliance officer has to VM-Ledger?

  1. A
    The officer has Reader permissions on VM-Ledger only if the virtual machine is added to an Administrative Unit scope where the officer has the Reader role.
  2. B
    The officer has no access to VM-Ledger because subscription-level role assignments do not inherit to resources within a resource group.
  3. The officer has Reader permissions on VM-Ledger because role assignments inherit down the resource hierarchy from the subscription level.Cevap
  4. D
    The officer has Reader permissions on VM-Ledger only if they are also assigned a directory-level administrator role in Microsoft Entra ID.

Cevap

The officer has Reader permissions on VM-Ledger because role assignments inherit down the resource hierarchy from the subscription level.
The correct answer is correct because Azure RBAC role assignments are inherited down the resource hierarchy. Since the compliance officer is assigned the Reader role at the subscription level, those permissions flow down to all resource groups and resources under that subscription, including the virtual machine in the finance resource group.

Adım Adım Çözüm

1
Identify the scope of the role assignment.
The Reader role is assigned to the user at the Subscription level (Sub-Billing).
Permissions in Azure RBAC are defined by the role and the scope at which it is applied.
2
Determine the resource inheritance chain.
The target resource (VM-Ledger) is inside the resource group (RG-Finance), which is under the subscription (Sub-Billing).
This establishes that the target resource is a descendant of the scope where the role is assigned.
3
Apply Azure RBAC inheritance rules.
The Reader role inherits down from the subscription to the resource group, and finally to the virtual machine.
Azure RBAC rules state that any permissions granted at a parent scope are inherited by child scopes and resources.

Anahtar Kavram

Azure RBAC Role Inheritance and Scopes
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru