Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC)

A company has an Azure environment with an active subscription named Enterprise-Sub. Inside this subscription, there is a resource group named App-RG, which contains an Azure App Service plan and an Azure SQL database.

Taylor is assigned the built-in Contributor role at the Enterprise-Sub subscription level.

Which of the following actions can Taylor perform within the App-RG resource group due to role inheritance? (Select TWO.)

  1. Create a new Web App under the App Service plan in App-RG.Cevap
  2. Delete the Azure SQL database inside App-RG.Cevap
  3. C
    Create an Azure Policy assignment to ensure all resources in App-RG are deployed only to the East US region.
  4. D
    Apply an Azure Policy that retroactively deletes any existing non-compliant resources inside App-RG.

Cevap

Taylor can create a new Web App under the App Service plan in App-RG, and delete the Azure SQL database inside App-RG.
Due to Azure RBAC inheritance, the Contributor role assigned at the subscription scope propagates down to all resource groups and resources under that subscription. Therefore, Taylor inherits Contributor rights in App-RG. The Contributor role allows full management of resources, including creating new resources (like a Web App) and deleting existing resources (like a SQL database).

Adım Adım Çözüm

1
Determine the effect of role assignment at the subscription level on child resources.
Taylor inherits the Contributor role permissions for the App-RG resource group and all resources within it (the App Service plan and the SQL database) because resource permissions propagate down the hierarchy.
Azure RBAC permissions assigned at a higher scope (Subscription) are inherited by all child scopes (Resource Groups and Resources) by default.
2
Identify the capabilities granted by the Contributor role.
Taylor can perform resource management operations, such as creating, deleting, and modifying resources, but cannot assign roles to other users or manage policies.
The built-in Contributor role grants full access to manage all resources but does not allow assigning roles in Azure RBAC or managing Azure Policies.
3
Evaluate which of the options fall under the allowed resource management actions and which fall under restricted management or policy actions.
Creating a Web App and deleting a SQL database are allowed resource management actions. Creating Azure Policy assignments or expecting policy to retroactively delete resources are policy-related and incorrect.
This step distinguishes between Azure RBAC resource management and Azure Policy governance.

Anahtar Kavram

Azure RBAC inheritance and the capabilities of the built-in Contributor role compared to Azure Policy.
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru