Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC)

An administrator needs to configure access to a virtual machine named Web-VM located in a resource group named App-RG.

The configuration must meet the following requirements:
1. A developer must be able to start, stop, and configure Web-VM.
2. The developer must not be able to grant access permissions to other users.
3. No user, including the developer, should be able to accidentally delete Web-VM.

To meet these requirements with the least privilege, which configuration should the administrator implement?

  1. A
    Assign the Contributor role to the developer at the Web-VM scope, and apply a ReadOnly lock to Web-VM.
  2. B
    Assign the Owner role to the developer at the Web-VM scope, and assign an Azure Policy at the App-RG scope to prevent the deletion of Web-VM.
  3. Assign the Contributor role to the developer at the Web-VM scope, and apply a Delete lock to Web-VM.Cevap
  4. D
    Configure an Azure Policy assignment at the App-RG scope that grants the developer permissions to manage Web-VM, and apply a Delete lock to Web-VM.

Cevap

Assign the Contributor role to the developer at the Web-VM scope, and apply a Delete lock to Web-VM.
The correct option assigns the Contributor role directly at the Web-VM resource scope, which allows the developer to manage the virtual machine but prevents them from delegating access to others (unlike the Owner role). Applying a Delete lock prevents accidental deletion of the resource while still allowing operational actions like starting and stopping the VM.

Adım Adım Çözüm

1
Determine the correct Azure Role-Based Access Control role that allows resource management but prevents access delegation.
The Contributor role permits full management (start, stop, configure) of the resource but does not allow managing permissions, unlike the Owner role.
This satisfies the requirement to allow configuration while preventing the developer from granting access to others.
2
Select the correct scope for the role assignment to adhere to the principle of least privilege.
Assign the role at the Web-VM resource level rather than the App-RG resource group level.
This limits the developer's permissions specifically to the required virtual machine.
3
Choose the appropriate resource lock to prevent accidental deletion while allowing normal operations.
A Delete lock prevents deletion but allows starting and stopping the VM, whereas a ReadOnly lock would block starting and stopping the VM.
This satisfies the requirement to prevent deletion while maintaining operational capabilities.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) roles, scopes, and resource locks integration
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru