Examkin

Soru

Zorluk: ZorAzure Role Assignments and Scopes

A cloud engineering team is designing a security model for a multi-tier application. The resource structure is configured as follows:

* Management Group: `MG-Finance-Core`
* Subscription: `Sub-Banking-Prod`
* Resource Group: `RG-Payment-Gateways`
* Key Vault: `kv-payment-prod`

The following security assignments are made:
* UserA is assigned the Reader role at the `MG-Finance-Core` scope.
* UserA is also assigned the Contributor role at the `RG-Payment-Gateways` scope.
* UserB is a Microsoft Entra ID Global Administrator, with no explicit Azure RBAC roles assigned to any Azure resource.
* UserC is assigned the User Access Administrator role at the `Sub-Banking-Prod` scope.

Which of the following statements describe the effective permissions of the users? (Select two.)

  1. UserA can deploy a new Virtual Network within the resource group RG-Payment-Gateways.Cevap
  2. UserC can delegate the Virtual Machine Contributor role to a developer at the RG-Payment-Gateways level.Cevap
  3. C
    UserB has full administrative access to manage all resources in the Sub-Banking-Prod subscription by default.
  4. D
    UserA is blocked from creating resources in RG-Payment-Gateways because the Reader role from MG-Finance-Core is inherited as a restriction.

Cevap

UserA can deploy a new Virtual Network within the resource group RG-Payment-Gateways, and UserC can delegate the Virtual Machine Contributor role to a developer at the RG-Payment-Gateways level.
The correct options are that UserA can deploy a new Virtual Network in the resource group, and UserC can delegate the Virtual Machine Contributor role at the resource group level. UserA is a Contributor at the resource group level, and since RBAC is additive, this allows full resource creation capabilities. UserC has the User Access Administrator role at the subscription level, which inherits downward and provides the necessary permissions to assign roles on the resource group.

Adım Adım Çözüm

1
Analyze UserA's effective permissions by combining the Reader role at the Management Group scope and the Contributor role at the Resource Group scope.
Since Azure RBAC is additive, UserA's effective permission in the resource group is Contributor, allowing resource creation (such as Virtual Networks) inside the resource group.
Permissions are accumulated across all scopes, and a more permissive assignment at a child scope is not restricted by a less permissive parent scope assignment.
2
Evaluate UserC's ability to manage role assignments inside the resource group.
UserC has the User Access Administrator role at the subscription scope, which inherits downward. This permits them to delegate roles at the subscription and child resource group scopes.
Role assignments are inherited, and the User Access Administrator role controls authorization settings (role assignments) within its scope.
3
Evaluate UserB's default access to subscription resources as a Global Administrator.
UserB has no resource permissions because directory-level roles do not automatically map to resource-level roles.
Microsoft Entra ID roles and Azure RBAC resource roles are separate systems; direct elevation is required to bridge the gap.

Anahtar Kavram

Azure RBAC uses an additive inheritance model where permissions propagate down the resource hierarchy (Management Group > Subscription > Resource Group > Resource). Direct directory roles like Global Administrator do not grant resource control plane permissions automatically.
Bu soruyu puanla

Konular

Azure Role Assignments and Scopes

Bu konudan daha fazla soru