An administrator needs to grant a user named Pat the ability to manage all resources within a resource group named RG-Compute, including the ability to assign permissions to other users. The administrator also wants to ensure that all resources deployed within RG-Compute comply with a corporate rule that restricts deployments to the 'West US' region.
Which combination of Azure features should the administrator use to meet these requirements?
- Assign Pat the Owner role for RG-Compute, and assign an Azure Policy to RG-Compute to restrict the deployment region.Cevap
- BAssign Pat the Contributor role for RG-Compute, and assign an Azure Policy to RG-Compute to manage user role assignments.
- CAssign Pat the User Access Administrator role for RG-Compute, and use Azure RBAC to restrict resource deployments to the 'West US' region.
- DAssign Pat the Owner role for RG-Compute, and use Azure RBAC role assignments to restrict the resource deployment regions.
Cevap
Assign Pat the Owner role for RG-Compute, and assign an Azure Policy to RG-Compute to restrict the deployment region.
Assigning Pat the Owner role for the resource group provides the necessary permissions to manage resources and delegate access control to others. Since Azure RBAC cannot enforce resource property restrictions, an Azure Policy must be applied to the resource group to restrict resource deployments to the 'West US' region.
Adım Adım Çözüm
Anahtar Kavram
Understanding the difference between Azure RBAC (identity-based access management) and Azure Policy (resource property compliance and enforcement), and how scopes and built-in roles inherit permissions.
Tahmini Süre:1m 0s