Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC)

To support a new analytics project, a junior database administrator must be given the ability to deploy and delete Azure SQL databases within an Azure resource group named Analytics-RG. However, to ensure security compliance, the junior administrator must be prevented from delegating access rights or assigning roles to other team members.

Which action should you perform to meet these requirements using the principle of least privilege?

  1. A
    Assign the Owner role to the junior administrator for the Analytics-RG resource group.
  2. Assign the Contributor role to the junior administrator for the Analytics-RG resource group.Cevap
  3. C
    Assign the User Access Administrator role to the junior administrator for the Analytics-RG resource group.
  4. D
    Assign the Reader role to the junior administrator for the Analytics-RG resource group and apply an Azure Policy that permits database creation.

Cevap

Assign the Contributor role to the junior administrator for the Analytics-RG resource group.
The Contributor role permits full management of Azure resources (including deploying and deleting SQL databases) within the assigned scope, but it does not allow the assignment of roles in Azure RBAC. Assigning this role at the Analytics-RG resource group level fulfills all requirements while adhering to the principle of least privilege.

Adım Adım Çözüm

1
Analyze the access requirements for the junior database administrator.
The administrator needs to perform resource management actions (deploy and delete SQL databases) but must not perform access control management actions (assigning roles).
This establishes the boundaries of the permissions needed.
2
Evaluate the capabilities of built-in Azure RBAC roles.
The Reader role only allows viewing resources. The User Access Administrator role only allows managing access. The Owner role allows both resource management and access management. The Contributor role allows resource management but explicitly excludes access management.
This allows selecting the role that matches the required permissions.
3
Determine the minimum scope and role that fits the requirements.
Assigning the Contributor role at the Analytics-RG resource group scope meets the operational needs without granting access management capabilities, which adheres to the principle of least privilege.
Applying the role at the resource group level ensures the permissions are limited to the target resources.

Anahtar Kavram

Azure Role-Based Access Control (RBAC)
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru