Examkin

Soru

Zorluk: ZorAzure Role-Based Access Control (RBAC)

An organization has an Azure management group named Enterprise-MG. A subscription named Subscription-A is grouped under Enterprise-MG. Within Subscription-A, there is a resource group named App-RG.

An administrator assigns a developer the Reader role at the Enterprise-MG scope.

The administrator must configure the environment to meet the following additional requirements:
- The developer must be able to create and manage all resources within App-RG.
- The developer must be prevented from deploying any resources to any other location in Subscription-A.
- All deployments in Subscription-A must be restricted to the West US region only.

Which of the following configurations should the administrator implement to meet these requirements?

  1. Assign the Contributor role to the developer at the App-RG scope, and assign an Azure Policy definition enforcing the allowed locations to the Subscription-A scope.Cevap
  2. B
    Assign the Contributor role to the developer at the App-RG scope, and assign an Azure Policy definition enforcing the allowed locations directly to the developer's user account.
  3. C
    Assign the Contributor role to the developer at the Subscription-A scope, and apply a ReadOnly resource lock to all resource groups in the subscription except App-RG.
  4. D
    Assign the Reader role to the developer at the App-RG scope, and assign an Azure Policy definition enforcing the allowed locations to the Subscription-A scope.

Cevap

Assign the Contributor role to the developer at the App-RG scope, and assign an Azure Policy definition enforcing the allowed locations to the Subscription-A scope.
To allow the developer to manage resources in App-RG while keeping view-only access elsewhere, the Contributor role must be assigned at the App-RG scope. Because Azure RBAC permissions are additive, the developer inherits the Reader role from the management group and gains Contributor permissions inside the resource group. Outside App-RG, they only have Reader access, which prevents them from deploying resources in other parts of the subscription. To enforce the region restriction across the entire subscription, an Azure Policy definition must be assigned to the Subscription-A scope, as Azure Policy is designed to enforce resource compliance rules like allowed deployment locations.

Adım Adım Çözüm

1
Analyze the baseline inherited permissions of the developer.
The developer inherits the Reader role at the Subscription-A and App-RG scopes from the assignment at Enterprise-MG.
Azure RBAC roles assigned at a higher scope (Management Group) automatically inherit down to all child scopes (Subscriptions and Resource Groups).
2
Determine the necessary role assignment to allow resource creation and management in App-RG only.
Assign the Contributor role to the developer at the App-RG scope.
Azure RBAC permissions are additive. Assigning Contributor at the App-RG scope grants write permissions locally. Because the developer only has the inherited Reader role at the subscription scope, they cannot create or modify resources outside of App-RG.
3
Identify the governance mechanism required to restrict deployment regions.
Assign an Azure Policy definition that enforces allowed locations to the Subscription-A scope.
Azure Policy is designed to enforce resource compliance rules, such as restricting deployments to approved regions. Unlike RBAC, which governs identity permissions, Azure Policy governs resource properties across the specified scope.

Anahtar Kavram

Azure RBAC permissions are additive and inherit down the resource hierarchy, while Azure Policy enforces compliance and resource properties at specified scopes.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru