Role-Based Access Control (RBAC) in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding RBAC Role Assignments

In Azure RBAC, what does a role assignment link together?

A A subscription, a resource group, and a policy

B A user, a role definition, and a scope

C A service principal, a key vault, and a certificate

D A virtual machine, a network, and a storage account

💡 Hint

Think about what three things must be connected to grant permissions.

In Azure RBAC, a role assignment connects a security principal (like a user), a role definition (which defines permissions), and a scope (where the permissions apply).

❓ security

intermediate

Least Privilege Principle in RBAC

You want to follow the least privilege principle in Azure RBAC. Which approach best supports this principle?

A Assign users the Reader role at the management group level

B Assign users the Owner role at the subscription level

C Assign users the Contributor role at the resource group level

D Assign users custom roles with only necessary permissions at the resource level

💡 Hint

Least privilege means giving only the permissions needed, no more.

Custom roles with only necessary permissions at the smallest scope help enforce least privilege by limiting access strictly to what is needed.

❓ service_behavior

advanced

Effect of Multiple Role Assignments on Permissions

If a user has two role assignments on the same resource: Reader and Contributor, what effective permissions does the user have?

A Only Reader permissions, because it is the most restrictive

B Only Contributor permissions, because it is the least restrictive

C Both Reader and Contributor permissions combined, effectively Contributor

D No permissions due to conflict between roles

💡 Hint

Think about how Azure combines permissions from multiple roles.

Azure RBAC combines permissions from all assigned roles, so the user effectively has the combined permissions, which in this case is Contributor.

❓ service_behavior

advanced

Role Assignment Scope Impact

You assign a user the Reader role at the resource group level. Which resources can the user read?

A All resources inside the resource group and the resource group itself

B Only the resource group itself, not the resources inside it

C All resources in the subscription, including other resource groups

D Only resources explicitly assigned to the user

💡 Hint

Consider what 'scope' means in Azure RBAC.

Assigning a role at the resource group level grants permissions on the resource group and all resources contained within it.

❓ Architecture

expert

Designing RBAC for Multi-Tenant Azure Environment

You manage an Azure environment hosting multiple tenants. Each tenant has its own subscription and resource groups. You want to allow tenant admins to manage only their subscription resources without affecting others. Which RBAC design best achieves this?

A Assign tenant admins Owner role at their respective subscription level only

B Assign tenant admins Owner role at the management group level containing all subscriptions

C Assign tenant admins Contributor role at the resource group level across all subscriptions

D Assign tenant admins Reader role at the subscription level and Owner role at resource group level

💡 Hint

Think about isolating permissions per tenant subscription.

Assigning Owner role at the subscription level for each tenant admin limits their control to only their subscription, preventing cross-tenant access.