Role-Based Access Control (RBAC) in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to assign a role to a user in Azure RBAC.

Azure

az role assignment create --assignee [1] --role "Reader" --scope /subscriptions/00000000-0000-0000-0000-000000000000

Drag options to blanks, or click blank then click option'

[e-mail]

BresourceGroup1

CstorageAccount1

DvirtualMachine1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a resource name instead of a user identifier for --assignee

Confusing the role name with the assignee

The --assignee parameter requires the user or service principal's identifier, such as an email or object ID. Here, [e-mail] is the correct assignee.

2fill in blank

medium

Complete the code to list role assignments for a specific resource group.

Azure

az role assignment list --scope [1]

Drag options to blanks, or click blank then click option'

A/resourceGroups/myResourceGroup

B/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup

C/subscriptions/00000000-0000-0000-0000-000000000000

D/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Compute/virtualMachines/myVM

Attempts:

3 left

💡 Hint

Common Mistakes

Using only the resource group name without subscription path

Using a resource ID for a different resource type

The --scope parameter requires the full resource ID. For a resource group, it starts with /subscriptions/.../resourceGroups/ followed by the group name.

3fill in blank

hard

Fix the error in the command to remove a role assignment by its ID.

Azure

az role assignment delete --ids [1]

Drag options to blanks, or click blank then click option'

A/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleAssignments/abcd1234-5678-90ef-ghij-klmnopqrstuv

BroleAssignmentId

CmyRoleAssignment

D12345

Attempts:

3 left

💡 Hint

Common Mistakes

Using only the GUID without full resource path

Using a friendly name instead of the resource ID

The --ids parameter requires the full resource ID of the role assignment, which includes the subscription, provider, and role assignment GUID.

4fill in blank

hard

Fill both blanks to create a custom role definition with permissions.

Azure

{
  "Name": "Custom Reader",
  "IsCustom": true,
  "Description": "Can read resources",
  "Actions": [[1]],
  "NotActions": [[2]]
}

Drag options to blanks, or click blank then click option'

A"Microsoft.Resources/subscriptions/resourceGroups/read"

B"Microsoft.Resources/subscriptions/resourceGroups/write"

C"*"

D"Microsoft.Compute/virtualMachines/start/action"

Attempts:

3 left

💡 Hint

Common Mistakes

Putting write permissions in Actions instead of NotActions

Using wildcards (*) incorrectly

The Actions list should include read permissions like "Microsoft.Resources/subscriptions/resourceGroups/read". The NotActions list excludes write permissions like "Microsoft.Resources/subscriptions/resourceGroups/write" to prevent modification.

5fill in blank

hard

Fill all three blanks to assign a built-in role to a service principal at subscription scope.

Azure

az role assignment create --assignee [1] --role [2] --scope [3]

Drag options to blanks, or click blank then click option'

A00000000-0000-0000-0000-000000000000

BContributor

C/subscriptions/00000000-0000-0000-0000-000000000000

[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using subscription ID alone without /subscriptions/ prefix for scope

Using role ID instead of role name

Using subscription ID as assignee

The --assignee is the service principal's email or object ID ([e-mail]). The --role is a built-in role like Contributor. The --scope is the subscription resource ID.