Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC) Configuration and Roles

Your department uses a multi-tier Azure resource layout to manage corporate workloads. The layout contains the following hierarchy:

* Management Group: MG-Corp-Prod
* Subscription: Sub-AppServices
* Resource Group: RG-WebApps
* Virtual Machines: vm-frontend-01, vm-frontend-02

You are tasked with assigning permissions to a security group named App-Operators. The members of App-Operators must be able to perform the following tasks:

1. Start, stop, and restart the virtual machines in RG-WebApps.
2. View monitoring metrics and activity logs for all resources in the Sub-AppServices subscription.

You need to assign the appropriate built-in Azure roles to App-Operators. The solution must follow the principle of least privilege.

Which two role assignments should you configure? (Select two.)

  1. Virtual Machine Contributor at the scope of the RG-WebApps resource groupCevap
  2. Monitoring Reader at the scope of the Sub-AppServices subscriptionCevap
  3. C
    Contributor at the scope of the MG-Corp-Prod management group
  4. D
    Security Reader Microsoft Entra ID directory role at the tenant scope

Cevap

Assign the Virtual Machine Contributor role at the scope of the RG-WebApps resource group and the Monitoring Reader role at the scope of the Sub-AppServices subscription.
To satisfy the VM power management requirement with least privilege, the security group should be assigned the Virtual Machine Contributor role at the scope of the RG-WebApps resource group. To satisfy the monitoring visibility requirement across the entire subscription, the security group should be assigned the Monitoring Reader role at the scope of the Sub-AppServices subscription. Both assignments target the narrowest necessary role and scope.

Adım Adım Çözüm

1
Identify the minimum required role and scope for the first requirement (manage VM power states).
The Virtual Machine Contributor role allows managing VM power states (start, stop, restart) without full resource control. The scope must be limited to the RG-WebApps resource group to enforce least privilege.
Assigning roles at lower scopes prevents accidental access or configuration changes in other resource groups.
2
Identify the minimum required role and scope for the second requirement (view monitoring metrics and logs).
The Monitoring Reader role allows reading all monitoring data (metrics and logs). The scope must be the Sub-AppServices subscription because the metrics and logs must be viewed for all resources within the subscription.
Assigning permissions at the subscription level allows inheritance to apply the Monitoring Reader role to all current and future resource groups within that subscription.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) scopes, built-in roles, and inheritance logic.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru