Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC)

An organization is setting up an Azure environment and needs to delegate resource management for a development team. A deployment specialist must be able to create, modify, and delete virtual machines within a specific resource group named ProjectX-RG. However, the specialist must not be allowed to delegate access permissions to other users or manage resource locks on ProjectX-RG. Which of the following options should you configure to meet these requirements?

  1. Assign the Contributor role to the specialist at the resource group scopeCevap
  2. B
    Assign the Owner role to the specialist at the resource group scope
  3. C
    Assign an Azure Policy definition to the resource group that allows virtual machine creation
  4. D
    Apply a ReadOnly resource lock to the ProjectX-RG resource group

Cevap

Assign the Contributor role to the specialist at the resource group scope
Assigning the Contributor role at the resource group scope allows the specialist to create and manage virtual machines within the specified resource group. The Contributor role does not grant permissions to manage access controls (which requires Owner or User Access Administrator) or change resource locks, satisfying all constraints.

Adım Adım Çözüm

1
Analyze the access control requirements for the specialist, which are managing virtual machines (create, modify, delete) without the ability to delegate access or manage locks.
Identified that the role must allow resource modification but restrict authorization/management tasks.
This establishes the scope of permissions needed.
2
Evaluate Azure Role-Based Access Control (RBAC) built-in roles.
The Contributor role grants full access to manage resources but does not allow assigning roles in Azure RBAC, which perfectly matches the requirements.
This distinguishes between Contributor and Owner roles.
3
Verify that Azure Policy and Resource Locks cannot be used to grant user permissions in this scenario.
Azure Policy regulates resource properties, and a ReadOnly lock would block all modifications.
This rules out non-RBAC options that would block the required actions.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) manages access by assigning roles (like Owner and Contributor) at specific scopes, while Azure Policy enforces compliance and Resource Locks prevent accidental changes.
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru