SC-300 Certification Practice Question #70

Question

You have an Azure subscription named Sub1 that contains the resources shown in the following table.

Sub1 contains the managed identities shown in the following table.

Sub1 has the role-based access control (RBAC) role assignments shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

This is a pure RBAC-scope-inheritance problem. Vault1 sits in RG1. Identity1 (on Automation1) is scoped to RG2, so it cannot read Vault1's secrets → No. Identity3 (on VM1) is scoped to RG1, which contains Vault1 → Yes. Row 2 is the subtle one: Identity2 is Automation2's system-assigned identity and is scoped at the subscription (Sub1) level, which by inheritance covers RG1 and therefore Vault1; the statement's "can be assigned to Automation2" is effectively already true (it is Automation2's own identity), and it already has the needed access → Yes. The MS Learn note that a system-assigned identity can only be associated with its single owning resource is why confidence is held at 83 rather than higher (the phrasing "can be assigned to" is loose), but both highly-engaged commenters converge on N/Y/Y and the scope math is unambiguous.

More SC-300 practice questions