Examkin

Soru

Zorluk: KolayAzure Role-Based Access Control (RBAC)

An organization has an Azure management group named Finance-MG that contains three Azure subscriptions. A user needs to view the configuration details of all resources across all three subscriptions, but must not be allowed to modify any resources or grant permissions to other users. Which of the following administrative actions should you perform to meet this requirement?

  1. A
    Create an Azure Policy at the Finance-MG level that blocks resource modification actions.
  2. B
    Apply a ReadOnly resource lock to the Finance-MG management group.
  3. Assign the Reader role to the user at the Finance-MG management group level.Cevap
  4. D
    Assign the Billing Reader role to the user at the Finance-MG management group level.

Cevap

Assign the Reader role to the user at the Finance-MG management group level.
Assigning the Reader role at the management group level allows the user to view all resource configurations across all subscriptions in that group due to inheritance, without permitting any modifications or access delegation.

Adım Adım Çözüm

1
Identify the required level of access (read-only access to resource configurations without modification or delegation capabilities).
The Reader built-in role matches this access level exactly.
The Reader role allows viewing resources but does not allow making changes (like Contributor) or managing access (like Owner/User Access Administrator).
2
Determine the scope where the role assignment should be applied to cover all three subscriptions.
The parent Finance-MG management group is the appropriate scope.
Due to Azure RBAC inheritance, permissions assigned at a parent management group propagate down to all child subscriptions and their nested resources.

Anahtar Kavram

Azure RBAC Scope and Inheritance
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru