Examkin

Soru

Zorluk: OrtaManagement Groups Hierarchies

An aviation logistics company, SkyRoute Global, organizes its Azure infrastructure using the following Management Group hierarchy:

- Tenant Root Group
- SkyRoute-MG (Management Group)
- Production-MG (Management Group)
- Sub-Prod-01 (Subscription)
- Sub-Prod-02 (Subscription)
- NonProd-MG (Management Group)
- Sub-Dev-01 (Subscription)

A policy restricting virtual machine SKUs is assigned at the SkyRoute-MG level.
Pat is assigned the Owner role at the Production-MG level.
Sam is assigned the Reader role at the Tenant Root Group level and the Contributor role at the Sub-Dev-01 subscription level.

Which two of the following statements correctly describe the behavior of policy and RBAC inheritance within this hierarchy?

  1. Pat can manage resources and assign permissions within both Sub-Prod-01 and Sub-Prod-02.Cevap
  2. B
    Sam cannot view resources in Sub-Prod-01 because the Reader role is assigned at the Tenant Root Group and does not inherit down.
  3. The VM SKU policy assigned at SkyRoute-MG applies to virtual machines created within Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01.Cevap
  4. D
    Pat can configure a policy exemption at the Resource Group level in Sub-Prod-01 that automatically exempts Sub-Prod-02 from the VM SKU policy.
  5. E
    Adding a Resource Lock to a resource group in Sub-Dev-01 will inherit upward and prevent the deletion of the NonProd-MG management group.

Cevap

The correct statements are that Pat can manage resources and assign permissions within both Sub-Prod-01 and Sub-Prod-02, and the VM SKU policy assigned at SkyRoute-MG applies to virtual machines created within Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01.
The Owner role assigned to Pat at the Production-MG level inherits downward to Sub-Prod-01 and Sub-Prod-02, granting full administrative control over both subscriptions. Additionally, the VM SKU policy applied at the SkyRoute-MG level inherits downward to all child scopes, meaning it applies to Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01.

Adım Adım Çözüm

1
Analyze the RBAC role inheritance for the Owner role assignment.
Pat's Owner role is assigned at Production-MG. Since Sub-Prod-01 and Sub-Prod-02 are child subscriptions under Production-MG, the Owner permissions inherit downward to both subscriptions.
Azure RBAC assignments inherit downward through the Management Group and subscription hierarchy.
2
Analyze the policy inheritance for the VM SKU policy.
The VM SKU policy is assigned at SkyRoute-MG. Because SkyRoute-MG is the parent of both Production-MG and NonProd-MG, all child subscriptions (Sub-Prod-01, Sub-Prod-02, and Sub-Dev-01) inherit this policy.
Azure Policy assignments inherit downward through the management group hierarchy and cannot be bypassed at child scopes unless an explicit exemption is configured.
3
Evaluate the directional limits of RBAC, policies, and locks.
Sam's Reader role inherits downward from the Tenant Root Group, policy exemptions do not apply laterally to sibling scopes, and resource locks do not inherit upward.
Permissions and locks only flow downward in the Azure hierarchy, and exemptions are scoped strictly to their defined targets.

Anahtar Kavram

Azure Management Groups provide a hierarchical structure for organizing subscriptions, allowing policies and RBAC roles to inherit downward systematically.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Management Groups Hierarchies

Bu konudan daha fazla soru