Exam SC-300 topic 1 question 88 discussion

Actual exam question from Microsoft's SC-300

Question #: 88
Topic #: 1

HOTSPOT
-

You have an Azure subscription named Sub1 that contains the resources shown in the following table.

Sub1 contains the managed identities shown in the following table.

Sub1 has the role-based access control (RBAC) role assignments shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Oskarma at Jan. 20, 2025, 4:49 p.m.

Comments

Submit Cancel

Frank9020

4 months, 2 weeks ago

1: Automation1 has Identity1 assigned to it. Identity1 has the Key Vault Secrets User role at the RG2 scope. Vault1 is in RG1, not RG2. Since Identity1 has access to secrets in RG2, but Vault1 is in RG1, Automation1 cannot access the secrets in Vault1. Answer: ❌ No 2: Identity2 is a system-assigned managed identity for Automation2. Identity2 has the Key Vault Secrets User role at the Subscription (Sub1) level. Sub1 includes RG1, where Vault1 is located. Since Identity2 has permission at the subscription level, which includes RG1, it already has access to Vault1. Answer: ✅ Yes 3: VM1 has Identity3 assigned to it. Identity3 has the Key Vault Secrets User role at the RG1 scope. Vault1 is in RG1. Since Identity3 has permissions for RG1, and Vault1 is in RG1, VM1 can access the secrets in Vault1. Answer: ✅ Yes

upvoted 4 times

...

Oskarma

4 months, 3 weeks ago

1. No. The scope of Identity1 isn’t RG1 (Vault1) 2. Yes. Indeed it’s assigned, and i’ts scope is all the Subscription Sub1 3. Yes. Identity3 is assigned to VM1 and it’s scope is RG1, where it’s Vault1

upvoted 3 times

...