Examkin

Soru

Zorluk: ZorAzure Role-Based Access Control (RBAC)

An organization has an Azure subscription containing multiple resource groups. An administrator wants to ensure that no users can create virtual machines within the subscription. The administrator removes all Owner and Contributor role assignments at the subscription level.

Is the statement 'Removing these role assignments at the subscription level guarantees that no users can create virtual machines anywhere within the subscription' true or false?

Cevap: Cevap

Cevap

The statement is false.
The correct answer is false because Azure RBAC permissions are additive. Removing subscription-level roles does not prevent users from having roles assigned directly at the resource group scope, which would allow them to create virtual machines in those specific resource groups. Furthermore, enforcing resource compliance subscription-wide is a capability of Azure Policy, not Azure RBAC.

Adım Adım Çözüm

1
Analyze the action taken by the administrator at the subscription scope.
All Owner and Contributor role assignments are removed at the subscription level, meaning no permissions are inherited from the subscription scope to child scopes for these roles.
To understand the baseline permissions inherited by resource groups.
2
Evaluate the possibility of RBAC role assignments at lower scopes.
Users can still be assigned roles like Contributor or Virtual Machine Contributor directly at the resource group scope.
Azure RBAC allows roles to be assigned at different levels (Management Group, Subscription, Resource Group, Resource), and permissions are additive.
3
Evaluate the role of Azure Policy vs. Azure RBAC for enforcing subscription-wide compliance rules.
Removing RBAC roles does not enforce a compliance rule; to guarantee that no virtual machines can be created subscription-wide, an Azure Policy with a Deny effect should be applied.
Azure Policy is designed for governing and enforcing resource creation standards, whereas RBAC is designed for managing identity-based permissions.

Anahtar Kavram

Azure RBAC inheritance and scope properties, and the distinction between Azure RBAC and Azure Policy.
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru