SC-300 Certification Practice Question #159

Question

You have an Azure subscription named Sub1 that contains two resource groups named RG1 and RG2. Sub1 contains the users shown in the following table.

Sub1 contains the resources shown in the following table.

You create the role-based access control (RBAQ role assignments shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

The whole question turns on RBAC scope. User1's only path to secret values is the Key Vault Secrets User role inherited via Group2, but that role is scoped to RG2; Vault1 sits in RG1, so User1's effective role on Vault1 is just Reader (via Group1 at the subscription), and MS Learn states the Reader role cannot read secret contents → Row 1 No. User2 is in Group2 and so is a Key Vault Secrets User at RG2, which contains Vault2, and that role grants "Read secret contents" → Row 2 Yes. User3 is in Group3, which holds Owner at RG1; VM1 resides in RG1, so Owner can update its configuration → Row 3 Yes. The Highly Voted comment (13 👍) plus two corroborating high-vote comments and MS Learn role definitions all converge on N/Y/Y; the lone Yes-for-Row-1 dissent ignores the RG2 scope boundary.

More SC-300 practice questions