Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AZ-103 Azure Administrator > Managing Azure Role Based Access Control (RBAC) > Flashcards

Managing Azure Role Based Access Control (RBAC) Flashcards

1
Q

RBAC - What is the maximum number of role assignments per Azure subscription?

A

2,000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RBAC - What is the maximum number of custom roles per tenant?

A

2,000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This lists the operations that can be performed on a security principal.

A

Role Definitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Generally termed as a “Role” it is a collection of permissions.

A

Role Definitions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

An object that represents an individual, collection of individuals, an application or service that requires access to an Azure resource.

A

Security Principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What 3 types of objects does a security principal object represent?

A

An individual.
A collection of individuals.
An application or service that requires access to an Azure resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

In reference to a security principal, individuals are represented by what?

A

An Azure AD user or a user in another tenant

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In reference to a security principal, a collection of individuals are represented by what?

A

An Azure AD group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In reference to a security principal, applications and services are represented by what?

A

A service principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are three examples or expressions of operations that are defined by a role definition?

A

Read, Write, and Delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The boundary that access applies to is…

A

Scope

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are four scopes that a role may be assigned?

A

Management group
Subscription
Resource group
Resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

(T/F) A role assignment can be inherited by a child scope level from its parent.

A

True.

Role assignments are structured in a parent-child relationship where access at the parent scope is inherited at child scope.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The identity to which the permissions will apply for a role assignment is…

A

… a security principal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The collection of permissions tied to a role assignment is…

A

… a role definition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A role assignment’s access applies to…

A

… a scope.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Why is RBAC used in Azure? (3 answers)

A
  1. Ensures that the principle of least privilege is used.
  2. Reduces chance of unauthorized actions being performed.
  3. Reduce chance of accidental actions being performed.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

(T/F) Role assignments are structured in a peer-to-peer relationship where access given to one security principal on a scope level is given to all other security principals.

A

False.

Role assignments are structured in a parent-child relationship where access at the parent scope is inherited at child scope.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

This entity represents all principals in an Azure AD and uses the “Zero” GUID.

A

The Everyone principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

This binds a set of actions to a security principal at a particular scope for the purpose of denying access.

A

Deny Assignments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

(T/F) Deny assignments are read-only.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

(T/F) Role assignments are read-only.

A

False, Deny Assignments are read-only.

23
Q

To prevent a user access to certain principals or prevent inheritance for assignments that are generally provided subscription-wide, an admin might use a…

A

… deny assignment.

24
Q

Management operations are specified in these two properties of a role definition.

A

“Actions” and “NotActions”

25
Q

Data operations are specified in these two properties of a role definition.

A

“DataActions” and “NotDataActions”

26
Q

The following are examples of what type of operation?

  • Create, update, or delete a blob container
  • Delete a resource group and its contents
  • Set up access to a storage account
A

Management Operations

27
Q

The following are examples of what type of operation?

  • Read a list of blobs in a container
  • Write to a storage blob in a container
  • Delete a message in a queue
A

Data Operations

28
Q

What are the four fundamental RBAC roles for most Azure features and a description of what they can do?

A 
Owner
- Manage everything including access to resources.
Contributor
- Manage everything except access to resources.
Reader
- Read only access to everything.
User Access Administrator
- Manage user access to Azure resources
29
Q

(T/F) An account that can manage security policies but not access a resource cannot grant itself access to that resource.

A

False

An account is able to grant itself access to any resource if it is allowed to manage security policies. This is, however, logged in Azure.

30
Q

What PowerShell cmdlet is used to create a role assignment for a principal?

A

New-AzRoleAssignment

Legacy: New-AzureRmRoleAssignment

31
Q

What Azure CLI command is used to create a role assignment for a principal?

A

az role assignment create

32
Q

Aside from using the Azure Portal, PowerShell, and the Azure CLI, what other methods can be used to create role assignments?

A

REST API

ARM Template

33
Q

This tracks what changes are made to role assignments and definitions.

A

RBAC Auditing

34
Q

Details of changes that are made to role assignments or role definitions within a subscription are written to…

A

… the Azure Activity Log.

35
Q

The Azure Activity Log can be directly queried for how long?

A

90 days

36
Q

(T/F) Azure Activity Log can be configured to store data for longer than the default amount of time.

A

True

37
Q

What five (5) RBAC operations are written to the Azure Activity Log?

A
  • Create role assignment
  • Delete role assignment
  • Create custom role definition
  • Update custom role definition
  • Delete custom role definition
38
Q

This sets certain requirements that allows or denies access to Azure management endpoints such as the Azure Portal.

A

Conditional Access policies

39
Q

What is required to be able to implement conditional access policies?

A

Azure Active Directory P2

40
Q

What are four (4) examples of policies that can be set by conditional access?

A
  • Sign-in risk
  • Device platform
  • Device state (compliance)
  • Location
41
Q

Which PowerShell cmdlet is used to view the assignment changes in a subscription that are recorded in the Azure Activity Log?

A

Get-AzLog

Legacy: Get-AzureRMLog

42
Q

This is used to enforce different rules and effects over Azure resources.

A

An Azure Policy.

For example it can control the types of resources that can be deployed or verify whether a particular resource exists during deployment of an ARM template.

43
Q

Define the difference between an RBAC and an Azure Policy?

A

RBAC focuses on what can be done within a scope while an Azure Policy controls the specifics of what is done. (ie. RBAC controls whether a user is allowed to deploy a VM, an Azure Policy controls how that VM is named)

44
Q

What are two scenarios where it is appropriate to use RBAC with Azure Policies?

A

Where consistency is needed over large subscriptions.

Where regulation compliance requires specific forms of control over the use of cloud resources.

45
Q

What can be used to audit whether and how specific RBAC roles are implemented within a subscription?

A

An Azure Policy

This can be accomplished by the use of an “auditIfNotExists” policy with an IF portion.

46
Q

(T/F) Role assignments can be automatically deployed.

A

True, with Azure Policy and ARM Templates.

Write a policy that audits for the presence of role assignments for certain role definitions and principals. This policy can pick up inherited permissions from parent Management Groups if role assignments were inherited. An administrator can use the “deployIfNotExists” property and specify an ARM Template with role assignment details to deploy.

47
Q

How do you determine within the Azure Portal whether a role definition is one of the built-in Azure roles or custom?

A

If the resource icon is orange instead of the default blue.

48
Q

(T/F) Custom role definitions cannot be shared across subscriptions.

A

False

49
Q

Role definitions are in what format?

A

JSON

50
Q

(T/F) The “NotActions” property in a custom role definition can be used to establish a deny operation rule for a security principal on a given resource.

A

False.

If a security principal is assigned a role that excludes an action in the “NotActions” property and then assigned a second role that grants access to that operation, the principal can perform that operation. To properly deny access to an operation a Deny Assignment must be used.

51
Q

What property within a custom role definition can be used to specify what scope a role can be used and what value will allow all scopes?

A

“AssignableScopes”

If this property is set to “/” it will allow the role to be assigned within all scopes.

52
Q

Which built-in roles have the appropriate permissions to create custom roles?

A

Owner or User Access Administrator

53
Q

Which two properties within a custom role definition do you add to allow or deny management operations?

A

“Actions” and “NotActions”

54
Q

Which two properties within a custom role definition do you add to allow or deny data operations?

A

“DataActions” and “NotDataActions”

AZ-103 Azure Administrator (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions