CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating Azure RBAC for Access Control: An AZ-104 Exam Question Walkthrough
This walkthrough clarifies a common decision point in the AZ-104 exam regarding Azure access control using RBAC.
Your organization has multiple departments, and you want to restrict their access to certain Azure virtual machines. What is the best way to achieve this?
The question
- A: Assign RBAC roles at the resource group level
- B: Assign RBAC roles at the subscription level
- C: Use Azure Policy to restrict access
- D: Use Network Security Groups (NSGs) to restrict access
Think before you scroll
Consider the scope of access control and how it applies to different Azure resources. Each option provides a different level of granularity for managing permissions. Understanding these nuances is crucial for making the correct choice.
The answer
The correct option is A: Assign RBAC roles at the resource group level. This choice allows you to tailor access permissions to specific resources, in this case, the virtual machines, based on the needs of each department. It strikes the right balance between control and flexibility.
Why the other options lose
B: Assign RBAC roles at the subscription level
This option applies permissions across all resources within the subscription. It lacks the granularity needed to restrict access to specific virtual machines, making it too broad for departmental requirements.C: Use Azure Policy to restrict access
While Azure Policy can enforce compliance and resource management rules, it does not manage access permissions directly. Therefore, it is not suitable for restricting user access to virtual machines.D: Use Network Security Groups (NSGs) to restrict access
NSGs control network traffic to and from Azure resources but do not manage user access permissions. This option fails to address the core requirement of restricting departmental access to specific virtual machines.
The concept behind it
This question tests your understanding of Role-Based Access Control (RBAC) within Azure. RBAC allows you to assign roles to users or groups, determining what they can access and what actions they can take. Assigning roles at the resource group level provides a targeted approach that can adapt to different department needs.
Exam trap to remember
Remember: Assigning RBAC at the resource group level is the best practice for controlling access to specific resources without overreaching.