Examkin

Soru

Zorluk: ZorAzure Role-Based Access Control (RBAC)

An administrator needs to configure permissions and governance rules for an Azure resource group named RG1. The configuration must meet the following requirements:
- A user named Alex must be able to start, stop, and configure virtual machines in RG1, but must be prevented from granting access to other users.
- Only virtual machine resources can be deployed in RG1; all other resource types must be blocked, regardless of any user's permissions.

Which two actions should you perform to meet these requirements?

  1. Assign the Contributor role to Alex for RG1.Cevap
  2. B
    Create a custom Azure RBAC role for Alex that explicitly denies the creation of non-virtual machine resources.
  3. Create and assign an Azure Policy to RG1 that restricts the allowed resource types to virtual machines.Cevap
  4. D
    Apply a ReadOnly resource lock to RG1.

Cevap

Assign the Contributor role to the user for the resource group, and create and assign an Azure Policy definition to the resource group that restricts allowed resource types.
Assigning the Contributor role ensures the user has full rights to manage virtual machines but cannot delegate permissions to others. Assigning an Azure Policy ensures that only virtual machines can be deployed, enforcing compliance regardless of any user's access level.

Adım Adım Çözüm

1
Evaluate the access requirements for managing virtual machines without access delegation.
Identify that the Contributor role grants full permissions to manage resources (like starting and stopping VMs) but prevents the user from managing access permissions.
Unlike the Owner role, the Contributor role does not grant User Access Administrator permissions.
2
Evaluate the governance requirement to restrict the types of resources that can be deployed.
Determine that Azure Policy is the correct tool to enforce compliance rules (such as allowed resource types) across a scope.
Azure RBAC only controls user permissions, whereas Azure Policy controls resource properties and compliance rules regardless of user permissions.
3
Assess the applicability of resource locks.
Determine that a ReadOnly lock is inappropriate because it blocks all administrative modification and control actions.
ReadOnly locks block virtual machine management operations such as starting or stopping the machines.

Anahtar Kavram

Azure RBAC vs Azure Policy, Contributor Role, and Resource Locks
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC)

Bu konudan daha fazla soru