Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC)

An Azure administrator assigns a user named Alex the Reader role at the subscription level. The subscription contains a resource group named Security-RG. The administrator needs to grant Alex the ability to manage all resources within Security-RG, while also enforcing a rule that prevents any user from deploying resources outside of the East US region within Security-RG. Which configuration should the administrator implement to meet these requirements?

  1. Assign Alex the Contributor role at the Security-RG level, and assign an Azure policy at the Security-RG level to restrict the allowed deployment regions.Cevap
  2. B
    Assign Alex the Contributor role at the Security-RG level, and assign an Azure RBAC role at the Security-RG level to restrict the allowed deployment regions.
  3. C
    Assign Alex the User Access Administrator role at the subscription level, and apply a ReadOnly resource lock to Security-RG to restrict the allowed deployment regions.
  4. D
    Assign Alex the Owner role at the Security-RG level, and use the Owner role properties to define the allowed deployment regions.

Cevap

Assign Alex the Contributor role at the Security-RG level, and assign an Azure policy at the Security-RG level to restrict the allowed deployment regions.
Assigning Alex the Contributor role at the Security-RG level grants write, read, and delete permissions for all resources within that resource group. Since RBAC permissions are additive, this extends his Reader role from the subscription level for this specific resource group. Additionally, enforcing a resource compliance rule like limiting deployment regions requires Azure Policy, which governs resource properties.

Adım Adım Çözüm

1
Evaluate the current permissions and the access requirement for Security-RG.
Alex has Reader access inherited from the subscription level, but needs Contributor access on Security-RG.
Since RBAC permissions are additive, assigning Contributor at the resource group level grants the necessary write/delete permissions for Security-RG without elevating permissions across the rest of the subscription.
2
Evaluate the requirement to restrict deployment regions.
Identify that restricting resource properties (like region) cannot be done via RBAC.
Azure Policy is the service specifically designed to enforce compliance rules and restrict resource properties such as allowed regions.
3
Combine the access assignment and compliance enforcement.
Assign the Contributor role to Alex on Security-RG, and assign the appropriate Azure Policy allowed locations rule to Security-RG.
This configuration satisfies both the authorization requirement for Alex and the resource property restriction for all deployments in the resource group.

Anahtar Kavram

Azure RBAC controls authorization (who can do what), while Azure Policy controls resource compliance (what properties resources can have).
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru