An organization is configuring access control for its Azure resources. You need to assign the appropriate built-in Azure RBAC roles to meet specific administrative requirements based on the principle of least privilege. Match each administrative requirement to the correct built-in Azure RBAC role.
- Deploy and manage virtual machines within a resource group, without permissions to manage virtual networks or storage accounts.Virtual Machine Contributor
- Assign Azure roles to users, groups, and service principals at the resource group scope, without resource creation permissions.User Access Administrator
- Manage all resources in a resource group, including creating and deleting resources, but cannot grant access to others.Contributor
- View all resources and configurations across a subscription, without permission to make any modifications or view secrets.Reader
Cevap
Each administrative requirement is matched to its corresponding Azure RBAC role based on the principle of least privilege: Virtual Machine Contributor for VM lifecycle management without network/storage permissions; User Access Administrator for role assignments; Contributor for full resource management without access delegation; and Reader for read-only access to resources.
Each assignment represents the minimum permissions required to perform the designated tasks. User Access Administrator allows granting roles without managing the resources. Contributor allows resource management without role delegation. Virtual Machine Contributor allows VM actions without storage/network modification. Reader allows auditing configurations without modification.
Adım Adım Çözüm
Anahtar Kavram
Azure Role-Based Access Control (RBAC) built-in roles and the principle of least privilege.
Tahmini Süre:2m 0s