Examkin

Soru

Zorluk: ZorAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization has an Azure environment structured with the following resource hierarchy:

* MG-Production (Management Group)
* Sub-Prod (Subscription)
* RG-App (Resource Group)
* VM-Web (Virtual Machine)
* RG-Data (Resource Group)
* sa-prod (Storage Account)
* kv-prod (Key Vault)

You are tasked with assigning built-in Azure role-based access control (RBAC) roles to four administrative security groups. Your configurations must strictly adhere to the principle of least privilege.

Match each administrative requirement to the correct Azure RBAC role and scope.

  • Restart and configure VM-Web, but must not be able to modify the virtual network or other resources in RG-App.Virtual Machine Contributor at the scope of VM-Web
  • Manage sa-prod configurations and regenerate access keys, but must not be granted direct data plane access to containers via Microsoft Entra ID.Storage Account Contributor at the scope of sa-prod
  • Read secret values inside kv-prod, but must not be able to modify key vault resource properties or management settings.Key Vault Secrets User at the scope of kv-prod
  • Assign roles across all resource groups within Sub-Prod, but must not be able to deploy or delete resource groups.User Access Administrator at the scope of Sub-Prod

Cevap

Requirement for VM-Web matches Virtual Machine Contributor at VM-Web scope; requirement for sa-prod matches Storage Account Contributor at sa-prod scope; requirement for kv-prod matches Key Vault Secrets User at kv-prod scope; requirement for Sub-Prod role assignment matches User Access Administrator at Sub-Prod scope.
The correct pairings match the security requirements to the most restricted built-in role and scope. Virtual Machine Contributor at the VM-Web scope limits VM control to only VM-Web. Storage Account Contributor at the sa-prod scope allows control plane settings management (like key regeneration) without granting Entra ID data access. Key Vault Secrets User at the kv-prod scope permits data-plane read access to secrets without administrative control plane capabilities. User Access Administrator at the Sub-Prod scope permits subscription-wide role assignment management without resource modification permissions.

Adım Adım Çözüm

1
Analyze the VM-Web requirement. The group needs to manage configuration and power state on VM-Web but not access networks or other resources. Virtual Machine Contributor is the built-in role that allows virtual machine management. The scope should be restricted to the VM-Web resource itself to satisfy least privilege.
WebAdmins is matched to Virtual Machine Contributor at the scope of VM-Web.
Limits VM management capability to the specific VM resource scope.
2
Analyze the sa-prod requirement. The group needs control plane management of the storage account (including key regeneration) but no Entra ID data plane access. Storage Account Contributor grants control plane access but does not grant data plane roles such as Storage Blob Data Reader or Contributor. The scope must be sa-prod.
AppDeployers is matched to Storage Account Contributor at the scope of sa-prod.
Restricts access to the control plane at the resource scope, denying Entra ID data access.
3
Analyze the kv-prod requirement. The group needs to read secret values but not manage policies or vault properties. Key Vault Secrets User is a data plane role that allows reading secrets without control plane permissions. The scope must be kv-prod.
SecAuditors is matched to Key Vault Secrets User at the scope of kv-prod.
Provides secrets data plane read access without administrative control plane permissions.
4
Analyze the Sub-Prod requirement. The group needs to manage role assignments across all resource groups under Sub-Prod but not modify resources. User Access Administrator is the Azure RBAC role that manages role assignments. The scope must be Sub-Prod so that it inherits to all child resource groups.
SecurityAdmins is matched to User Access Administrator at the scope of Sub-Prod.
Allows subscription-wide role delegation while preventing resource creation/deletion.

Anahtar Kavram

Azure RBAC roles and scopes configuration
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru