Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure RBAC for Fine-Grained Access Control
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
A financial services organization is implementing a cloud governance strategy across its expanding Azure infrastructure. The security team must delegate operational management of virtual machines and databases to development teams while ensuring that developers cannot modify billing configurations, delete subscriptions, or access resources in production environments.
Which Azure feature should the organization use to assign and restrict fine-grained resource permissions across management scopes?
Explanations
Virtual network segmentation
Virtual network segmentation
What Virtual Network Segmentation Is
Virtual network segmentation is a network security control strategy that divides cloud networks into isolated subnets, virtual networks, and security zones using Network Security Groups (NSGs), route tables, and firewalls.
Why It Doesn't Meet the Requirement
Network segmentation controls network traffic flow and prevents unauthorized communication between systems at the IP packet and protocol level. However, it does not manage user identity permissions or control who can create, modify, or delete Azure resources through the Azure Resource Manager control plane.
Key Characteristics and Limitations
- Network Layer Control: Filters ingress and egress traffic between IP addresses, subnets, and ports rather than controlling user authorizations.
- No Management Plane Awareness: Network segmentation cannot prevent a developer with excessive privileges from modifying cloud resource settings through the Azure portal or CLI.
- Traffic Isolation Focus: Intended to limit lateral movement of network threats rather than enforce administrative delegation.
This Answer Would Be Correct If
The organization required isolating production database network traffic from development application subnets to block unauthorized network packets.
Additional Context
Network segmentation is an essential layer of a defense-in-depth architecture, but administrative access governance must be handled at the identity layer using Azure RBAC.
Resource tags
Resource tags
What Resource Tags Are
Resource tags are metadata elements composed of key-value pairs applied directly to Azure resources, resource groups, and subscriptions. They are primarily used to categorize resources logically for cost tracking, environment identification, and asset reporting.
Why It Doesn't Meet the Requirement
While tags help organize resources across subscriptions, they do not function as an access control mechanism. Applying a tag such as Environment: Development to a virtual machine does not restrict user actions, enforce least privilege, or prevent unauthorized users from deleting or reconfiguring resources.
Key Characteristics and Limitations
- Metadata Only: Tags provide descriptive information for asset management and billing filters, but they carry no built-in authorization or enforcement engine.
- No Permission Boundaries: Tagging a resource does not grant, limit, or revoke access permissions for users or groups.
- Inheritance Limitations: Resource tags applied to a resource group are not automatically inherited by the resources residing within that resource group.
This Answer Would Be Correct If
The organization needed a mechanism to categorize resources for cost allocation, department chargebacks, or inventory reporting across various subscriptions.
Additional Context
Tags can complement Azure Policy to enforce governance standards (e.g., denying deployment of resources that lack mandatory cost center tags), but they cannot replace Azure RBAC for identity and access management.
Azure role-based access control (Azure RBAC)
Azure role-based access control (Azure RBAC)
What Azure RBAC Is
Azure role-based access control (Azure RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management of Azure resources. It allows organizations to grant only the precise permissions that users, groups, and service principals need to perform their daily duties, enforcing the security principle of least privilege.
How It Meets the Requirements
- Fine-Grained Permission Assignment: Azure RBAC enables precise delegation of operational actions (such as managing virtual machines and databases) through built-in roles like Contributor or custom roles.
- Scope-Based Access Control: Permissions can be applied at multiple hierarchical levels, including management groups, subscriptions, resource groups, and individual resources, preventing developers from accessing unauthorized production scopes.
- Separation of Concerns: RBAC isolates operational resource management from subscription-level billing management, ensuring developers cannot alter billing relationships or delete root-level subscriptions.
Key Advantages and Capabilities
- Hierarchical Inheritance: Role assignments made at higher scopes (such as management groups or subscriptions) inherit downward to child resource groups and resources.
- Extensive Built-In Roles: Provides dozens of pre-configured roles like Owner, Contributor, and Reader tailored to standard administrative tasks.
- Identity Integration: Integrates natively with Microsoft Entra ID users, security groups, and managed identities for seamless authentication and authorization.
- Custom Role Definitions: Supports creating tailored JSON role definitions when specialized control and granular actions are necessary.
Why This Is Optimal
Unlike broad subscription administrator privileges or metadata labeling, Azure RBAC is designed specifically to enforce authorization boundaries. It provides granular, auditable control over cloud resource operations across distinct organizational scopes without exposing sensitive billing and account management capabilities.
Billing account administrator roles
Billing account administrator roles
What Billing Roles Are
Billing account administrator roles manage the commercial and billing relationship between an organization and Microsoft. These roles operate under agreement models such as the Microsoft Customer Agreement (MCA) or Enterprise Agreement (EA).
Why It Doesn't Meet the Requirement
Billing roles govern financial activities, such as viewing invoices, managing payment methods, and creating subscriptions, but they do not manage individual technical resources (like virtual machines and databases). Granting billing permissions does not provide granular operational control or prevent access across technical development and production environments.
Key Characteristics and Limitations
- Financial Scope: Primarily focused on contracts, invoice downloads, cost management scopes, and billing profile settings.
- Distinct Separation from RBAC: Billing roles operate in a separate control plane from Azure RBAC resource management.
- Lack of Granular Resource Control: A billing account administrator cannot manage specific workload configurations unless explicitly assigned a corresponding Azure RBAC role.
This Answer Would Be Correct If
The organization needed to appoint a finance manager to review cloud spending, update payment methods, or download monthly tax invoices.
Additional Context
Azure intentionally separates billing roles from Azure RBAC roles to maintain strict segregation of duties between procurement/finance personnel and cloud infrastructure engineers.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Sentinel
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Regulatory Compliance
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Key Vault
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure VPN Gateway vs ExpressRoute
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated