Identity: RBAC

Question 1

A role definition file

Answer 1

is a set of properties defined in a JSON file.

Name
ID
Description
Actions - allowable permissions
NotActions - denied permissions
AssignableScopes - scope

Question 2

Owner Role - Actions and NotActions

Answer 2

Actions: {*} #allowed everything
NotActions: {} #no denied actions

Question 3

Contributor Role: Actions and NotActions

Answer 3

allow all actions except writing or deleting role assignment

Actions: *
NotActions: Microsoft.Authorization//Delete, Microsoft.Authorization//Write. Microsoft.Authorization/elevateAccess/Action

Question 4

Reader Role : Actions and NotActions

Answer 4

allowed to read only

Actions: {*/read}

Question 5

Roles: AssignableScopes property

Answer 5

specifies the role scope - subscriptions, resource groups or resources.

• /subscriptions/[subscription id]
• /subscriptions/[subscription id]/resourceGroups/[resource group name]
• /subscriptions/[subscription id]/resourceGroups/[resource group name]/[resource]

Question 6

Role Inheritance

Answer 6

A resource inherits role assignment from its parent resource

Question 7

Azure AD roles vs Azure RBAC roles

Answer 7

Azure RBAC roles control permissions to manage Azure resources (more fine grained)
Azure AD administrator roles control permissions to manage Azure Active Directory resources.

Question 8

Azure RBAC (Security Principal)

Answer 8

A security principal is a user, group or application that you want to grant access to.

Question 9

Azure RBAC (Role Definition)

Answer 9

A role definition is a collection of permissions.

Question 10

Azure RBAC (Scope)

Answer 10

Scope is where the access applies to.

Can be specified at multiple levels: management group, subscription, resource group or resource.

Permissions are inherited by child scopes. (i.e., assigning Contributor role at Resource Group level then all Resources in that Resource Group get the same permissions)

Question 11

Azure RBAC (Role Assignment)

Answer 11

A role assignment is the process of binding a role to a security principal at a particular scope.

Question 12

Suppose a team member can’t view resources in a resource group. Where would the administrator go to check the team member’s access?

Answer 12

Go to the resource group and select Access Control(IAM) > Check Access

Question 13

Suppose an administrator in another department needs access to a virtual machine managed by your department. What’s the best way to grant them access to just that resource?

Answer 13

At the resource group create a role for them with appropriate access.

Question 14

Suppose a developer needs full access to a resource group. If you are following least-privilege best practices, what scope should you specify?

Answer 14

Resource Group

Question 15

Suppose an administrator needs to generate a report of the role assignments for the last week. Where in the Azure portal would they generate that report?

Answer 15

Search for Activity Log and filter on the Create role assignment (roleAssignments) operation.