Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC)

An administrator needs to configure access for an external security audit team. The team must be able to view the configurations of all resources inside an Azure resource group named 'Production-RG'. However, they must not be allowed to modify any configurations, delete any resources, or manage user role assignments. Which Azure administration feature should the administrator assign to the security audit team to meet these requirements?

  1. The built-in Reader role at the resource group scopeCevap
  2. B
    An Azure Policy definition configured to audit write operations on the resource group
  3. C
    A ReadOnly resource lock applied to the resource group
  4. D
    An Azure resource tag named AccessLevel set to ReadOnly applied to the resource group

Cevap

The built-in Reader role at the resource group scope
The built-in Reader role at the resource group scope is the correct choice because it grants the security audit team the ability to view all resources and their configurations within the 'Production-RG' resource group. It adheres to the principle of least privilege by not allowing modifications, deletions, or role assignment changes.

Adım Adım Çözüm

1
Identify the primary requirement, which is to allow a specific team to view resource configurations without making changes or managing access.
The requirement is an access control task rather than a compliance enforcement or metadata tagging task.
Determining the correct Azure management tool ensures we focus on Azure Role-Based Access Control (RBAC) rather than Azure Policy, Resource Locks, or Tags.
2
Evaluate the built-in Azure RBAC roles to find the one that matches the requested permissions.
The Reader role allows read-only access to resources at the assigned scope, whereas the Owner or Contributor roles would allow modifications.
Matching the permissions ensures that the principle of least privilege is followed.
3
Confirm that the selected role is applied at the correct scope to restrict access to the resource group.
Assigning the Reader role at the resource group scope restricts the team's read access only to 'Production-RG'.
Applying the role at the resource group scope limits the blast radius and access boundary to only the target resources.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) allows administrators to manage access to Azure resources by assigning built-in or custom roles at specific scopes.
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru