Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
How Azure RBAC Scope Limits Resource Access
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An IT administrator needs to grant a developer permission to manage all cloud resources located inside a specific resource group named App-Dev-RG. The developer must not have access to any other resource groups or services across the Azure subscription.
Which core component of an Azure Role-Based Access Control (Azure RBAC) role assignment defines the boundary of resources to which the assigned permissions apply?
Explanations
Scope
Scope
What Scope Is
In Azure Role-Based Access Control (Azure RBAC), a scope represents the specific resource, or set of resources, that an identity is permitted to access. It defines the boundary where permissions take effect within the Azure resource hierarchy.
How It Meets the Requirement
By setting the scope of the role assignment directly to the App-Dev-RG resource group, the administrator ensures that the assigned permissions apply only to the resources inside that container. Access will not spill over to other sibling resource groups within the same subscription.
Key Advantages and Capabilities
- Hierarchical enforcement: Scopes exist across four hierarchical levels: management group, subscription, resource group, and individual resource.
- Inheritance model: Permissions assigned at a higher parent level automatically cascade down to child scopes, simplifying bulk permission management.
- Principle of least privilege: Administrators can restrict access to the smallest possible boundary (such as a single resource or resource group) to prevent unauthorized actions.
- Granular segregation: Multiple teams can manage different resource groups within the same subscription without interfering with one another.
Why This Is Optimal
The scope is the only fundamental RBAC component designed specifically to establish resource boundaries. Configuring the scope correctly ensures that security policies adhere to the principle of least privilege.
Role assignment ID
Role assignment ID
What a Role Assignment ID Is
A role assignment ID is a unique identifier (formatted as a GUID) assigned to a specific role assignment instance when it is created in Azure.
Why It Doesn't Meet the Requirement
The role assignment ID serves strictly as an administrative and programmatic identifier for tracking, referencing, modifying, or deleting the role assignment in Azure Resource Manager. It has no functional role in defining resource boundaries or permission boundaries.
Key Characteristics and Limitations
- Globally unique identifier: Uses a 128-bit GUID format (
00000000-0000-0000-0000-000000000000). - Unique per tenant: Must be unique within the Microsoft Entra tenant, regardless of scope.
- Metadata identifier: Acts merely as a resource identifier for the assignment record itself.
This Answer Would Be Correct If
A scenario asked how Azure uniquely identifies and tracks an individual role assignment record when deploying via Azure Resource Manager templates or Bicep.
Additional Context
Reusing a role assignment ID across multiple deployments will cause deployment failures because each assignment requires its own distinct identity.
Security principal
Security principal
What a Security Principal Is
A security principal is an object representing the identity requesting access to Azure resources. In Azure, security principals are managed in Microsoft Entra ID.
Why It Doesn't Meet the Requirement
A security principal answers the who question of access management rather than the where. It represents the target user, group, service principal, or managed identity, but does not define the resource boundaries or limitations where access takes effect.
Key Characteristics and Limitations
- Identity types: Includes individual users, security groups, service principals (applications), and managed identities.
- Object identification: Identified uniquely within Microsoft Entra ID using an Object ID (GUID).
- No spatial boundary: A principal alone has zero permissions and no scope until attached via a role assignment.
This Answer Would Be Correct If
A scenario asked to identify the component of an RBAC assignment that specifies the individual user, group, or application identity receiving access.
Additional Context
While selecting the developer as the security principal is a mandatory step in creating a role assignment, it does not determine which resource groups or subscription assets the developer can touch.
Role definition
Role definition
What a Role Definition Is
A role definition (often simply called a role) is a collection of permissions that outlines what operations can be executed on Azure resources.
Why It Doesn't Meet the Requirement
A role definition answers the what question of access control by listing allowed Actions, NotActions, and data operations (such as reading, writing, or deleting). However, it does not establish the boundary of resources where those actions are allowed to be performed.
Key Characteristics and Limitations
- Permission sets: Lists specific control plane and data plane operations using resource provider strings (e.g.,
Microsoft.Compute/virtualMachines/*). - Built-in and custom: Azure includes built-in roles like Owner, Contributor, and Reader, while allowing custom roles tailored to organization-specific permissions.
- Scope-independent: A role definition can be reused across any scope level without inherently containing resource boundary constraints.
This Answer Would Be Correct If
The question asked which RBAC component lists the permissible actions, such as whether a user can read, create, modify, or delete virtual machines.
Additional Context
To manage resources in App-Dev-RG, the administrator might select the Contributor role definition, but the boundary itself is strictly defined by the role assignment's scope.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor Audit Log Retention
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Custom Roles
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope and Role Assignment
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope Inheritance
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Files
Describe storage account options and storage types
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated