Practice Test
Multiple Select: The Azure role-based access control (RBAC) allows you to grant granular permissions to:
- A. Management Groups
- B. subscriptions
- C. Resource Groups
- D. Resources
- E. Monitor Connections
- F. DNS Zones
Answer: A, B, C, D
Explanation: RBAC in Azure allows you to grant permissions to manage Azure resources on management groups, subscriptions, resource groups, and resources only.
True/False: Azure role permissions can only be configured for subscriptions and not for resource groups.
Answer: False
Explanation: Azure role permissions can be configured for subscriptions, as well as resource groups, management groups and resources.
True/False: Azure built-in roles include Reader, Contributor, and Owner.
Answer: True
Explanation: Azure has several built-in roles, and these include Reader, Contributor, and Owner. These can be assigned at different scopes including subscriptions, resource groups, and resources.
Single select: Which Azure role grants full access to Azure resources?
- A. Reader
- B. Administrator
- C. Contributor
- D. Owner
Answer: D. Owner
Explanation: In Azure, the Owner role grants full access to Azure resources, including the right to delegate access to others.
True/False: You can deny permissions to a specific resource in Azure by using a Deny assignment.
Answer: True
Explanation: Deny assignments in Azure are used to explicitly deny permissions to specific Azure resources.
Multiple select: Azure custom roles can be created through which of the following methods:
- A. Azure portal
- B. Azure PowerShell
- C. Azure CLI
- D. ARM template
- E. Azure SDKs
Answer: A, B, C, D
Explanation: Azure custom roles can be created using the Azure portal, Azure PowerShell, Azure CLI or an ARM template.
Single select: RBAC role assignments in Azure are transitive through the _________.
- A. Resource groups
- B. Role definitions
- C. Resources
- D. Management groups
Answer: D. Management groups
Explanation: RBAC role assignments are transitive through the hierarchy of the management groups. This means that permissions can be granted at a higher scope, such as the management group, and automatically apply to the lower scopes within it.
True/False: Azure policy assignments at the management group can include or exclude specific resource groups.
Answer: True
Explanation: Azure policy assignments at the management group level can exclude specific resource groups within the policy Assignment.
Multiple Select: When testing access to resources, which Azure feature can be utilized?
- A. Check Access
- B. Activity Log
- C. Azure Monitor
- D. Azure Advisor
Answer: A, B, C
Explanation: Azure offers Access reviews, Activity logs and Azure Monitor to test and verify access to resources.
Single select: Which scope type can effectively manage access for multiple Azure subscriptions?
- A. Resource
- B. Resource Groups
- C. Subscriptions
- D. Management Groups
Answer: D. Management Groups
Explanation: A Management Group is a container of multiple subscriptions that can be used to manage access, policies, and compliance for those subscriptions collectively.
True/False: Azure Identity governance manages the identity life cycle of users and groups in an organization.
Answer: True
Explanation: Azure Identity Governance helps you to manage the identity life cycle of users and groups, govern access across your organization, protect sensitive data, and efficiently meet your compliance needs.
Single select: Which Azure role permission allows you to view everything, but not make any changes?
- A. Reader
- B. Administrator
- C. Contributor
- D. Owner
Answer: A. Reader
Explanation: The Reader role in Azure allows you to view and inspect everything, but it does not allow you to make any changes to the resources.
Multiple Select: Which of the following Azure built-in roles can create and manage all types of Azure resources but can’t grant access to others?
- A. Contributor
- B. Reader
- C. Owner
- D. User Access Administrator
Answer: A. Contributor
Explanation: The Contributor can create and manage all types of Azure resources but can’t grant access to others. This limitation makes sure they can’t make themselves an owner or a User Access Administrator of the resources.
True/False: Azure role permissions cannot be configured for individual resources.
Answer: False
Explanation: Azure role permissions can be configured at several scopes, including individual resources such as virtual machines or storage accounts.
Single select: _________ in Azure allows you to grant granular permissions to specific resources in a secure way.
- A. Azure Security Center
- B. Azure Firewall
- C. Azure Active Directory
- D. Azure role-based access control (RBAC)
Answer: D. Azure role-based access control (RBAC)
Explanation: Azure RBAC allows you to grant granular permissions to specific resources in a secure way. With RBAC, you can grant only the amount of access that users need to perform their tasks.
Interview Questions
What is the first requirement to assign Azure role permissions?
The first requirement is having the necessary permissions to assign roles, with Microsoft requiring that the user should have the Microsoft.Authorization/roleAssignments/write permission.
How can permissions across multiple Azure subscriptions be centralized?
Centralization can be achieved by setting up a management group. Once the management group is set up, the role assignments can then be applied to a user, group, service principal, or managed identity at the management group level.
Can Azure role assignments be inherited?
Yes, role assignments are inherited by child scopes. For example, an assignment at the management group scope applies to all the subscriptions, resource groups, and resources under that management group.
What is the use of Azure ‘Owner’ role?
An Azure ‘Owner’ role has full access to all resources including the right to delegate access to others.
What is Azure ‘Contributor’ role?
Azure ‘Contributor’ role has full access to create and manage all types of Azure resources but can’t grant access to others.
Can custom roles be created in Azure?
Yes, Azure allows the creation of custom roles if the built-in roles do not meet the specific organizational requirements.
Which command is used to assign a role in Azure CLI?
It is ‘az role assignment create’. This command creates a new role assignment for a user, a group or a service principal.
Do I need access to a subscription to manage resources?
No, access to a subscription is not necessary. Access can be given to resources or resource groups directly without giving access to the whole subscription.
Can a user see a resource that they do not have permissions to in Azure?
No, Azure implements an access control model allowing you to see only the resources that you have permissions to. This is a fundamental security measure in Azure Resource Manager.
What are Management Groups used for in Azure Permissions?
Management Groups in Azure are used to manage access, policies, and compliance across multiple Azure subscriptions.
Can role assignments be deleted in Azure?
Yes, role assignments can be deleted. This revokes the access that was provided by the assignment.
What Azure role allows for reading resources, but not making any changes?
The ‘Reader’ role gives the user permission to view existing resources, but not create or change them.
What is the ‘User Access Administrator’ role in Azure?
The ‘User Access Administrator’ role allows you to manage user access to Azure resources.
Can a single Azure role be assigned to multiple users at once?
Yes, a single role can be assigned to multiple users, groups, or service principals.
What is the maximum number of role assignments that can exist per Azure subscription?
The maximum number is 2000 role assignments per Azure subscription.
extutorials.com