Examkin

Soru

Zorluk: ZorAzure Role-Based Access Control (RBAC) Configuration and Roles

Your company has an Azure environment that contains a management group named Tenant-MG. Tenant-MG contains an Azure subscription named Sub1. Inside Sub1, there is a resource group named RG-App.

You have a Microsoft Entra ID security group named App-Admins.

You need to ensure that members of App-Admins can manage Azure RBAC role assignments for resources within RG-App. The solution must follow the principle of least privilege and prevent App-Admins from managing role assignments for other resource groups in Sub1 or modifying the configuration of resources within RG-App.

Which administrative action should you perform?

  1. Assign the User Access Administrator role to App-Admins at the RG-App scope.Cevap
  2. B
    Assign the Owner role to App-Admins at the RG-App scope.
  3. C
    Assign the User Administrator role to App-Admins in Microsoft Entra ID.
  4. D
    Assign the User Access Administrator role to App-Admins at the Sub1 scope.

Cevap

Assign the User Access Administrator role to App-Admins at the RG-App scope.
Assigning the User Access Administrator role at the RG-App scope is correct because the User Access Administrator role specifically grants the authorization actions needed to manage Azure RBAC role assignments without granting contributor or owner access to the resources. Applying this at the resource group scope ensures that permissions are constrained only to resources within that specific group, satisfying the principle of least privilege.

Adım Adım Çözüm

1
Identify the required permissions for managing role assignments.
The action requires Microsoft.Authorization/roleAssignments/write and Microsoft.Authorization/roleAssignments/delete permissions.
This determines which roles are capable of managing access control.
2
Select the built-in role that satisfies these permissions with least privilege.
The User Access Administrator role allows managing role assignments but does not grant access to modify the resources themselves, whereas Owner would grant both.
To adhere to the principle of least privilege and meet the constraint that configuration changes are prohibited.
3
Determine the appropriate scope for the role assignment.
The assignment must be at the RG-App scope.
Assigning at the subscription level would inherit down to other resource groups, violating the scope restriction requirement.

Anahtar Kavram

Azure RBAC roles allow delegating specific management duties like access control separately from resource configuration management, and the scope of these assignments controls the boundary of the delegated permissions.
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru