Examkin

Soru

Zorluk: ZorAzure Role-Based Access Control (RBAC)

An organization has an Azure subscription containing a resource group named 'SecOps-RG'. An administrator needs to configure access permissions for an auditor named User1 to meet the following requirements:
- User1 must be able to view the configuration of all resources across the entire subscription.
- User1 must be able to delegate permissions to other users, but this capability must be restricted only to resources within the 'SecOps-RG' resource group.
- The principle of least privilege must be followed.

Which of the following configuration steps should the administrator perform? (Select TWO.)

  1. Assign User1 the Reader role at the subscription scope.Cevap
  2. Assign User1 the User Access Administrator role at the 'SecOps-RG' resource group scope.Cevap
  3. C
    Assign User1 the Contributor role at the subscription scope.
  4. D
    Create an Azure Policy at the subscription scope that delegates role assignment permissions in 'SecOps-RG' to User1.
  5. E
    Apply a ReadOnly resource lock at the subscription scope and assign User1 the Owner role at the subscription scope.

Cevap

Assign User1 the Reader role at the subscription scope, and assign User1 the User Access Administrator role at the 'SecOps-RG' resource group scope.
To satisfy the requirements with the least privilege, User1 needs the Reader role at the subscription scope to view all resources across the entire subscription. To delegate permissions (role assignments) restricted only to the 'SecOps-RG' resource group, the User Access Administrator role must be assigned at the resource group scope. This combination allows reading the entire subscription and managing role assignments specifically within 'SecOps-RG' without giving permissions to delete or modify the actual resources.

Adım Adım Çözüm

1
Analyze the read-only requirement.
User1 needs to view configurations across the entire subscription. The Reader role at the subscription scope grants this access with the least privilege.
The Reader role allows viewing resource configurations but does not allow any modifications.
2
Analyze the access delegation requirement.
User1 must delegate permissions only within 'SecOps-RG'. The User Access Administrator role assigned at the resource group scope grants access-management permissions restricted to that resource group.
Assigning User Access Administrator at the resource group scope allows role assignment (RBAC management) within that boundary while obeying the principle of least privilege, as it does not grant resource-modification rights (unlike the Owner role).

Anahtar Kavram

Azure RBAC Scopes and Built-in Roles
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru