Built-in roles (Owner, Contributor, Reader) in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Role Capabilities: Owner vs Contributor

Which of the following statements correctly describes the difference between the Owner and Contributor built-in roles in Azure?

A Contributor can manage access permissions and resources; Owner can only manage resources but not access permissions.

B Owner can manage access permissions and resources; Contributor can only manage resources but not access permissions.

C Both Owner and Contributor can manage access permissions but only Owner can delete resources.

D Owner can only view resources; Contributor can manage resources and access permissions.

💡 Hint

Think about who can change who else can access resources.

The Owner role has full access including managing access permissions, while the Contributor can manage resources but cannot assign roles or change access permissions.

❓ service_behavior

intermediate

Reader Role Behavior

What is the expected behavior of a user assigned the Reader role on an Azure resource group?

A The user can view all resources but cannot make any changes.

B The user can create and delete resources but cannot assign roles.

C The user can modify resource configurations but cannot delete them.

D The user can assign roles to other users but cannot view resources.

💡 Hint

Consider what 'Reader' implies about permissions.

The Reader role allows viewing resources and their properties but does not allow any modifications or role assignments.

❓ security

advanced

Security Implications of Assigning Owner Role

Which security risk is most associated with assigning the Owner role to many users in an Azure subscription?

A Users will be restricted from assigning roles, causing bottlenecks in access management.

B Users will be unable to view resources, causing operational delays.

C Users will only have read access, limiting their ability to manage resources effectively.

D Users might accidentally delete resources or change access permissions, leading to potential data loss or unauthorized access.

💡 Hint

Think about what full access means for security.

Assigning Owner role grants full control including managing access permissions, which can lead to accidental or malicious changes if too many users have it.

❓ Architecture

advanced

Designing Role Assignments for a Team

You have a team where some members need to deploy and manage resources, others only need to monitor resources, and a few need to manage access permissions. Which combination of built-in roles should you assign?

A Assign Reader to those managing access, Contributor to those deploying resources, Owner to those monitoring.

B Assign Contributor to those managing access, Owner to those deploying resources, Reader to those monitoring.

C Assign Owner to those managing access, Contributor to those deploying resources, Reader to those monitoring.

D Assign Contributor to all team members regardless of their tasks.

💡 Hint

Match roles to the level of access needed for each task.

Owner role is needed for managing access, Contributor for resource management, and Reader for monitoring only.

✅ Best Practice

expert

Minimizing Risk with Built-in Roles

What is the best practice to minimize security risks when assigning built-in roles like Owner, Contributor, and Reader in Azure?

A Assign the least privilege role necessary for the user's tasks and regularly review role assignments.

B Assign Contributor role to all users so they can manage resources and access permissions freely.

C Assign Owner role to all users to avoid permission issues and simplify management.

D Assign Reader role to all users to prevent accidental changes, regardless of their job function.

💡 Hint

Think about security principles and ongoing management.

Following the least privilege principle and reviewing assignments regularly reduces risk of unauthorized access or accidental changes.