Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization has an Azure environment structured with the following hierarchy:

* Management Group: `MG-Logistics`
* Subscription: `Sub-Shipments`
* Resource Group: `RG-CoreServices`
* Storage Account: `stashipdata`
* Resource Group: `RG-ComputeVets`

You need to configure access for a security group named `Group-LogisticsAdmins` to meet the following requirements:
1. Members of the group must be able to view all resources in the `Sub-Shipments` subscription.
2. Members of the group must be able to upload, download, and delete blobs inside the `stashipdata` storage account.
3. The configuration must follow the principle of least privilege.

Which two role assignments should you configure? (Select two.)

  1. Assign the Reader role to Group-LogisticsAdmins at the Sub-Shipments subscription scope.Cevap
  2. Assign the Storage Blob Data Contributor role to Group-LogisticsAdmins at the stashipdata storage account scope.Cevap
  3. C
    Assign the Contributor role to Group-LogisticsAdmins at the RG-CoreServices resource group scope.
  4. D
    Assign the Global Reader role to Group-LogisticsAdmins in Microsoft Entra ID.
  5. E
    Assign the Reader role to Group-LogisticsAdmins at the MG-Logistics management group scope and configure an Azure RBAC deny assignment for the RG-ComputeVets resource group.

Cevap

The correct assignments are Reader at the Sub-Shipments subscription scope and Storage Blob Data Contributor at the stashipdata storage account scope.
Assigning the Reader role at the subscription scope allows members to view all resources in that subscription, satisfying the first requirement under the principle of least privilege. Assigning the Storage Blob Data Contributor role at the storage account scope provides the necessary read, write, and delete permissions to the storage blob data plane under the principle of least privilege.

Adım Adım Çözüm

1
Identify the role needed to view all resources in the subscription.
The Reader role allows users to view resources but not make changes.
This satisfies the requirement to view all resources in the Sub-Shipments subscription under the principle of least privilege.
2
Identify the role and scope required to manage blob data in the storage account.
The Storage Blob Data Contributor role at the storage account scope provides read, write, and delete permissions to blob data.
Standard Azure control-plane roles (like Contributor or Reader) do not grant data-plane access to blobs. Scoping this role specifically to the stashipdata storage account adheres to the principle of least privilege.
3
Verify that all requirements are met and no invalid configurations are used.
Combining Reader at the subscription level and Storage Blob Data Contributor at the storage account level meets all access goals and follows least privilege.
This avoids granting excessive control-plane permissions (like Contributor) and ensures that security settings are scoped correctly.

Anahtar Kavram

Azure RBAC differentiates between control-plane and data-plane access. For data-plane operations in Azure Storage, specific roles (like Storage Blob Data Contributor) must be assigned, as control-plane roles (like Reader or Contributor) do not inherit data-plane access. Furthermore, permissions inherit down the scope hierarchy, and custom deny assignments are not supported in user-defined RBAC.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru