Examkin

Soru

Zorluk: OrtaAzure Role Assignments and Scopes

An administrator configures the following resource hierarchy and role assignments in an Azure environment:

* Microsoft Entra Tenant: The Access management for Azure resources property is set to No.
* Management Group: `MG-CoreServices`
* Subscription: `Sub-SharedServices`
* Resource Group: `rg-networking` (contains a Virtual Network named `vnet-prod`)
* Resource Group: `rg-identity`

A user named User1 is assigned the following roles:
* Global Administrator in the Microsoft Entra tenant
* Reader at the `MG-CoreServices` management group scope
* Network Contributor at the `rg-networking` resource group scope

You need to identify the effective permissions of User1.

Which of the following statements are correct? (Select TWO.)

  1. User1 can view the configuration of all resources in the rg-identity resource group.Cevap
  2. User1 can modify the configuration of vnet-prod.Cevap
  3. C
    User1 has administrative write permissions on all resources in the Sub-SharedServices subscription due to their Microsoft Entra ID Global Administrator role.
  4. D
    The Reader role assignment at the management group level overrides the Network Contributor assignment, preventing User1 from modifying vnet-prod.

Cevap

User1 can view the configuration of all resources in the rg-identity resource group, and User1 can modify the configuration of vnet-prod.
The user is able to view the configuration of all resources in the identity resource group and modify the configuration of the virtual network. The Reader role assigned at the management group scope inherits down through the subscription to all resource groups, including the identity resource group, enabling read access. The Network Contributor role assigned at the networking resource group scope grants management permissions on the virtual network. Since Azure RBAC permissions are additive, the Reader assignment at the higher management group level does not restrict the write permissions granted at the resource group level.

Adım Adım Çözüm

1
Determine the impact of the Reader role assignment at the management group level.
User1 gains read-only access to all resources in Sub-SharedServices, including rg-networking and rg-identity.
Azure RBAC role assignments inherit down the resource hierarchy: Management Group -> Subscription -> Resource Group -> Resource.
2
Determine the impact of the Network Contributor role assignment at the resource group level.
User1 gains contributor permissions on network resources in rg-networking, such as vnet-prod.
The Network Contributor role grants management permissions on networking resources. These permissions apply to the resource group scope and all child resources inside it.
3
Evaluate the additive nature of RBAC assignments and any conflict resolution.
User1 can modify vnet-prod because the write permissions from the Network Contributor role are added to the read permissions from the Reader role.
Azure RBAC permissions are additive, meaning the effective permissions are the union of all assigned roles. A Reader assignment at a higher scope does not override a Contributor assignment at a lower scope.
4
Evaluate the Microsoft Entra ID Global Administrator role assignment.
The Global Administrator role provides no permissions on Sub-SharedServices resources.
Microsoft Entra ID roles and Azure RBAC roles are managed on separate planes. Without explicit RBAC role assignments or access elevation (which is disabled), Global Administrators do not have access to Azure resources.

Anahtar Kavram

Azure RBAC Inheritance and Role Additive Nature vs Microsoft Entra ID Directory Roles
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru