An enterprise administrator manages access controls for a corporate Tenant Root Group. Und… — Microsoft Azure Administrator (AZ-104)

An enterprise administrator manages access controls for a corporate Tenant Root Group. Under this root group, a production subscription named `Sub-Prod` is created, which houses two resource groups: `RG-App-Prod` and `RG-Data-Prod`.

To implement the security baseline, the administrator must grant access to three administrative teams (Team A, Team B, and Team C) using the principle of least privilege.

Match each team's requirement to the correct role and scope configuration.

Team A requires the ability to grant and revoke access permissions for users across all resources in the Sub-Prod subscription, but must not be able to create or manage resources directly.User Access Administrator role assigned at the Sub-Prod subscription scope
Team B requires the ability to create, delete, and modify virtual machines, storage accounts, and networks inside the RG-App-Prod resource group, but must not have access to manage permissions.Contributor role assigned at the RG-App-Prod resource group scope
Team C requires the ability to inspect the configuration settings of all resources under Sub-Prod without the capability to write changes or view secret keys.Reader role assigned at the Sub-Prod subscription scope

Cevap

Team A matches with User Access Administrator role assigned at the Sub-Prod subscription scope; Team B matches with Contributor role assigned at the RG-App-Prod resource group scope; Team C matches with Reader role assigned at the Sub-Prod subscription scope.

The correct pairings map Team A to User Access Administrator at the subscription scope, Team B to Contributor at the resource group scope, and Team C to Reader at the subscription scope. This configuration perfectly satisfies the administrative needs while enforcing the narrowest scope and correct role separation.

Adım Adım Çözüm

Analyze Team A's requirements.

The requirement demands delegation of access management (RBAC role assignments) without resource management capabilities. The built-in User Access Administrator role is designed exactly for this. Since it must apply to all resources in Sub-Prod, the scope must be the Sub-Prod subscription.

Least privilege requires choosing a role that only allows identity management without resource manipulation.

Analyze Team B's requirements.

The requirement demands full resource management (VMs, storage, networks) within a single resource group, RG-App-Prod, without access delegation capability. The Contributor role allows resource management but prevents role assignment. Setting the scope specifically to RG-App-Prod limits access to only that resource group.

Restricting the scope to the specific resource group and choosing Contributor instead of Owner prevents access delegation and limits resource management to the target scope.

Analyze Team C's requirements.

The requirement demands read-only access to all resource configurations in the subscription (including both resource groups) without write actions or secret exposure. The Reader role provides read-only access. Assigning it at the subscription scope leverages inheritance so that it automatically applies to all resources under Sub-Prod.

Reader is the standard role for read-only visibility without write or data-plane secret access.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) relies on three components: security principal (identity), role definition (permissions), and scope (resource boundaries). Least privilege is achieved by assigning the minimum required role at the narrowest scope necessary.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru