Access policies vs RBAC in Azure - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to assign a role to a user using Azure RBAC.

Azure

az role assignment create --assignee [1] --role "Reader" --scope /subscriptions/00000000-0000-0000-0000-000000000000

Drag options to blanks, or click blank then click option'

AstorageAccount1

BvirtualMachine1

CresourceGroup1

[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using a resource name instead of a user identity as assignee.

Confusing the role name with the assignee.

The assignee must be a user or service principal identity, such as an email address, to assign a role in RBAC.

2fill in blank

medium

Complete the code to create an access policy for an Azure Key Vault.

Azure

az keyvault set-policy --name MyKeyVault --object-id [1] --secret-permissions get list

Drag options to blanks, or click blank then click option'

AresourceGroup1

B00000000-0000-0000-0000-000000000000

CReader

DMyKeyVault

Attempts:

3 left

💡 Hint

Common Mistakes

Using the Key Vault name instead of the object-id.

Using role names instead of object-id.

The object-id is the unique identifier of the user or service principal for whom the access policy is set.

3fill in blank

hard

Fix the error in the command to assign a role at the resource group level.

Azure

az role assignment create --assignee [e-mail] --role [1] --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup

Drag options to blanks, or click blank then click option'

AContributor

BmyResourceGroup

[e-mail]

DKey Vault

Attempts:

3 left

💡 Hint

Common Mistakes

Using resource group name as role.

Using user email as role.

The role parameter must be a valid Azure role name like Contributor, Reader, or Owner.

4fill in blank

hard

Fill both blanks to create an access policy that grants secret permissions.

Azure

az keyvault set-policy --name MyVault --object-id [1] --[2]-permissions get list

Drag options to blanks, or click blank then click option'

A00000000-0000-0000-0000-000000000001

Bkey

Csecret

Dcertificate

Attempts:

3 left

💡 Hint

Common Mistakes

Using resource names instead of object-id.

Mixing permission types incorrectly.

The object-id identifies the user, and the permission type must be either key, secret, or certificate. Here, secret-permissions are granted.

5fill in blank

hard

Fill all three blanks to assign the Reader role to a user at a subscription scope.

Azure

az role assignment create --assignee [1] --role [2] --scope [3]

Drag options to blanks, or click blank then click option'

[e-mail]

BReader

C/subscriptions/00000000-0000-0000-0000-000000000000

DContributor

Attempts:

3 left

💡 Hint

Common Mistakes

Using resource names instead of user email for assignee.

Using invalid role names.

Incorrect scope format.

The assignee is the user email, the role is Reader, and the scope is the subscription ID path.