Examkin

Soru

Zorluk: Çok zorAzure Role Assignments and Scopes

An organization has a Microsoft Entra ID tenant and the following Azure resource hierarchy:
* Management Group: MG-Root
* Azure Subscription: Sub-Ops
* Resource Group: RG-Prod-Shared
* Storage Account: sa-prod-logs (contains a blob container named `security-logs`)

The following settings and assignments are configured:
1. A user named User1 is assigned the Security Reader role in Microsoft Entra ID.
2. The tenant-level directory setting Access management for Azure resources is set to No.
3. User1 is assigned the User Access Administrator role at the Sub-Ops subscription scope.
4. User1 is assigned the Reader role at the RG-Prod-Shared scope.
5. A resource lock of type ReadOnly is applied directly to the sa-prod-logs storage account.

Which of the following describes the effective permissions of User1?

  1. A
    User1 cannot assign any roles at the RG-Prod-Shared scope because the Reader role assignment at the resource group scope overrides the inherited User Access Administrator permissions.
  2. B
    User1 can upload blobs to the security-logs container using their inherited User Access Administrator permissions but cannot assign roles at the RG-Prod-Shared scope.
  3. User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container.Cevap
  4. D
    User1 can delete the sa-prod-logs storage account because the Microsoft Entra ID Security Reader role elevates their control plane privileges to bypass resource locks.

Cevap

User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container.
The correct option is that User1 can assign the Reader role to other users at the RG-Prod-Shared scope but cannot upload blobs to the security-logs container. User1 inherits the User Access Administrator role from the subscription level, which is additive and not overridden by the Reader assignment at the resource group level. Because User Access Administrator does not provide data plane permissions, User1 cannot write blobs to the storage container.

Adım Adım Çözüm

1
Analyze the impact of User1's Microsoft Entra ID role and the directory setting.
Since the directory setting 'Access management for Azure resources' is set to 'No', User1's Global Administrator or Security Reader directory roles do not grant User Access Administrator rights on Azure subscription resources.
By default, Microsoft Entra ID administrator roles do not inherit permissions to Azure resources unless access management is explicitly enabled and elevated.
2
Determine the effective Azure RBAC permissions inherited by User1.
User1 has the User Access Administrator role at the subscription scope (Sub-Ops) and the Reader role at the resource group scope (RG-Prod-Shared). Under Azure RBAC, permissions are additive. The User Access Administrator role inherits down to all child scopes, giving User1 role management permissions at both RG-Prod-Shared and sa-prod-logs. The Reader role assignment does not override or deny these inherited permissions.
Azure RBAC roles do not deny permissions; they only add them. An explicit assignment at a lower scope (Reader) does not negate an inherited role from a higher scope (User Access Administrator).
3
Evaluate data plane access to the storage account sa-prod-logs.
Neither User Access Administrator (which only manages authorization) nor Reader (which reads resource configuration) grants data plane write permissions to upload blobs.
Control plane roles do not automatically grant data plane access (such as writing blobs to a container) without specific data plane roles like Storage Blob Data Contributor.
4
Synthesize the final effective permissions.
User1 can perform role assignments (like assigning the Reader role) at the resource group level but cannot upload blobs to the security-logs container.
This aligns with User1's effective control plane role (User Access Administrator) and lack of data plane roles.

Anahtar Kavram

Azure RBAC role inheritance, additive permissions, and the boundary between control plane roles and data plane access.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru