AZ-301 Exam - Question 14

Question

Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription named Project1. Only a group named Project1admins is assigned roles in the Project1 subscription. The Project1 subscription contains all the resources for an application named Application1.

Your company is developing a new application named Application2. The members of the Application2 development team belong to an Azure Active Directory

(Azure AD) group named App2Dev.

You identify the following requirements for Application2:

✑ The members of App2Dev must be prevented from changing the role assignments in Azure.

✑ The members of App2Dev must be able to create new Azure resources required by Application2.

✑ All the required role assignments for Application2 will be performed by the members of Project1admins.

You need to recommend a solution for the role assignments of Application2.

Solution: In Project1, create a resource group named Application2RG. Assign Project1admins the Owner role for Application2RG. Assign App2Dev the Contributor role for Application2RG.

Does this meet the goal?

Examice · Accepted Answer

Assigning the Project1admins the Owner role for Application2RG and App2Dev the Contributor role for Application2RG meets the goals. The Contributor role grants the App2Dev team the ability to create new Azure resources required by Application2 without the ability to change role assignments, aligning with the requirement to prevent App2Dev members from changing role assignments. The Owner role given to Project1admins allows them to manage role assignments as required. Therefore, this solution addresses all the outlined requirements.

Anindya · Answer

SHould be yes as access can be provided as RG level as well

spidy · Answer

The answer is no, because the Resource Group Owner will not have permission to register for Azure Resource Provider which will need Subscription Level access. Contributor can create any resource that is already registered in Azure Resource Provider however not the ones that are not. So this is the tricky part of this question. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-providers-and-types

deepak · Answer

should be yes. recommended solution is creating RG over Subscription unless you have certain needs like applying poliicies where subsccription is a better solution

KaiW · Answer

I think the answer should be 'yes' too. unless there are some other groups have owner / contributor access in the subscription and they don't want them to be able to access the RG?

Ekramy_Elnaggar · Answer

it should be A , as it is fulfilling the requirements

chan76 · Answer

why the answer is not yes?

Screebie · Answer

Why is this no?

teresam · Answer

Should be yes..

akamal · Answer

it should be yes,
because if we considered app2dev belongs to different AD tenant, this means that project1admins group isn't available on this new AD tenant which isn't the case here on this question

Jake__ · Answer

"You have an Azure subscription named Project1. Only a group named Project1admins is assigned roles in the Project1 subscription. The Project1 subscription contains all the resources for an application named Application1."

It then changes the application to app2, doesnt tell us what subscription its in, so how would we know if its in subsciription 1 or another? We dont, hopefully if question is on exam it elaborates these details.

azlearn · Answer

I think because of this statement " The members of App2Dev must be able to create new Azure resources required by Application2" the answer is NO, if you assign App2Dev group Contributor for only RG, they are limited only to that RG.

Rajuuu · Answer

The Answer is Yes…Using a Single Subscription , one can create 2 resource group and assign the Contributor role to the new Resource group.. 
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/resource-consistency/governance-multiple-teams

Neetiniti · Answer

Answer:-A. Yes, If you assign the Contributor role to an application at the resource group scope, it can manage resources of all types in that resource group, but not other resource groups in the subscription. https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

dumbu · Answer

I tend to agree with the No reason the subscription has "Only a group named Project1admins is assigned roles in the Project1 subscription". App2Dev is part of diff AD group so it must be in diff subscription.

toja1234 · Answer

No is correct.
The DevTeam should be able to create ALL Resources required for Application2.
This could include a new ResourceGroup, which is not possible if its on RG level.
We need a new Subscription.

pradjhun · Answer

"Only a group named Project1admins is assigned roles in the Project1 subscription." this statement say no other group can be assigned role in Project1sebscrption so how we achieve this with RG

DJ_IL · Answer

Should be a Yes

Jt909 · Answer

To me it's Yes as clearly defined here (just 20/25 minutes to read all the examples) https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/resource-consistency/governance-multiple-teams

rpasrija · Answer

should be Yes

milind8451 · Answer

Tested in lab. In my views "Yes" is right ans.

cj93s3 · Answer

if this question comes up, i am going with yes

cozzy · Answer

The answer is yes, read the requirements properly, there is nothing saying is has to be in a different subscription, this may be a "recommended" practice but is not a requirement of this solution.. the correct answer is yes

AhmedAL · Answer

answer should be A

glam · Answer

A. Yes

kondapaturi · Answer

Yes is also right..not sure why it is No. Becuase RBAC can be applied on Resource group also.

P0d · Answer

In a question there is no requirement for the different subscription. So we can create app2 in same subscription and assign proj1 admins as the owner of App2RG. and assign App2den group as contributor. 
The answer should be Yes.

yilpiz · Answer

I think it should be yes. App2Dev has only Contributor role which satisfy the requirements of not being able to change assignment and being able to create resources in RG2

kumar123 · Answer

My vote is also yes. 
"Only a group named Project1admins is assigned roles in the Project1 subscription" - They did not mention anything about AD for Project1admins. For this reason they are recommending to create a subscription? not sure.

mtb123 · Answer

They do not share resources, so a contributor would not be able to create these resources in a single subscribtion
 The answer is correct. If it was implied that they use the same resources then they could be created in the same subscription and app 2users would then be given contributor access. But thats not the case so the answer is correct.

jonnybugaloo · Answer

I agree it should be Yes.
There is no mention about different AD tenant, so, we can't consider this as an eliminatory point.
The explicity requirenments are:

The members of App2Dev must be prevented from changing the role assignments in Azure.
- Contributor role doesn't aloow this
The members of App2Dev must be able to create new Azure resources required by Application2.
- Contributor role aloows this
All the required role assignments for Application2 will be performed by the members of Project1admins.
 - Owner can do this

Contributor - Can create and manage all types of Azure resources but can't grant access to others.
Owner - Has full access to all resources including the right to delegate access to others.
https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

DeveshSolanki · Answer

Yes should be

Andy_Lee · Answer

Should be yes. It fulfillment request

eug45 · Answer

the answer is A.

sanketshah · Answer

A is correct

varunthakur84 · Answer

Correct answer is YES
Access can be granted at subscription as well as RG levels
 In this question main point to set right role (owner/contributor) to the correct ADD group. 
Owner - can do user assignment
Contributor can create new resources

omth · Answer

jfhkjw

AZ-301 Exam - Question 14

Discussion