Examkin

Soru

Zorluk: OrtaAzure Role-Based Access Control (RBAC)

A company has an Azure Management Group named MG-Sales. You need to assign permissions to a security officer. The officer must be able to assign roles and delegate access permissions for all subscriptions within MG-Sales, but should not be allowed to create or modify virtual machines or databases. Which configuration should you assign to the security officer to meet these requirements?

  1. The User Access Administrator role at the Management Group scopeCevap
  2. B
    The Owner role at the Management Group scope
  3. C
    An Azure Policy definition assigned to the Management Group
  4. D
    A ReadOnly resource lock applied to the Management Group

Cevap

The User Access Administrator role at the Management Group scope
The correct answer is the User Access Administrator role at the Management Group scope. This built-in role allows the security officer to manage user access (assign roles) to Azure resources, and because it is assigned at the Management Group level, these permissions inherit down to all subscriptions. Unlike the Owner role, it does not grant permissions to create or modify resources such as virtual machines or databases, which aligns with the principle of least privilege.

Adım Adım Çözüm

1
Analyze the permission requirements.
The target user needs role delegation capabilities but must be blocked from resource creation/modification.
This establishes the scope of control to focus on access management only.
2
Evaluate the inheritance scope.
The target scope is a Management Group containing multiple subscriptions.
Assigning permissions at the Management Group level ensures the settings propagate down to all child subscriptions through inheritance.
3
Select the built-in role.
Choose User Access Administrator over Owner.
While both allow role assignments, the Owner role also allows resource modification, which violates the restriction. User Access Administrator isolates role delegation without resource-plane management rights.

Anahtar Kavram

Azure Role-Based Access Control (RBAC) Built-in Roles and Scope Inheritance
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru