az-104 Practice Question 739
Exam: az-104
Domain: Describe Azure architecture and services
Topic: Describe Azure identity, access, and security
Difficulty: medium
HOTSPOT -
You configure the custom role shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Answer Options
A
To ensure that users can sign in to virtual machines that are assigned role1, modify the [actions] section. To ensure that role1 can be assigned only to a resource group named RG1, modify the [assignableScopes] section.
Correct Answer
A: To ensure that users can sign in to virtual machines that are assigned role1, modify the [actions] section. To ensure that role1 can be assigned only to a resource group named RG1, modify the [assignableScopes] section.
Explanation
Box 1: roletype -
You need to configure Azure RBAC policy to determine who can log in to the VM. Two Azure roles are used to authorize VM login:
Virtual Machine Administrator Login: Users with this role assigned can log in to an Azure virtual machine with administrator privileges.
Virtual Machine User Login: Users with this role assigned can log in to an Azure virtual machine with regular user privileges.
Note, example roletype:
"roleName": "Virtual Machine Administrator Login",
"roleType": "BuiltInRole",
"type": "Microsoft.Authorization/roleDefinitions"
Box 2: assignableScopes -
Azure role-based access control (Azure RBAC) is the authorization system you use to manage access to Azure resources. To grant access, you assign roles to users, groups, service principals, or managed identities at a particular scope.
When you assign roles, you must specify a scope. Scope is the set of resources the access applies to. In Azure, you can specify a scope at four levels from broad to narrow: management group, subscription, resource group, and resource.