Exam AZ-103 topic 4 question 2 discussion

Answer is Network Contributor on RG for both

Here is the catch. The solution must follow the principle of least privilege. That's why network contributor.

Correct

This question is explained in below video https://youtu.be/GP9DRSOgssM

For Health Probe also, without having access to RG1, no health probe can be added. If only Network Contributor role is assigned to LB then the user would not be able to access the IP addresses of the member pools. Owner/Contributor can give the user access for everything. So it will not fit into the the principle of least privilege. Hence Owner and contributor role is incorrect choices for the question.

Got a nice explanation from Az-104 udemy practise tests Answer: Network Contributor on RG for both 1. To add to the backend pool, write permission is required on the Resource Group because it writes deployment information. To add a backend pool, you need network contributor role on the LB and on the VMs that will be part of the backend pool. For this reason the network contributor role must be assigned to the RG where the LB and the VM resides. So the correct answer is Network Contributor on RG1. 2. For Health Probe also, without having access to RG1, no health probe can be added. If only Network Contributor role is assigned to LB then the user would not be able to access the IP addresses of the member pools. Owner/Contributor can give the user access for everything. So it will not fit into the the principle of least privilege. Hence Owner and contributor role is incorrect choices for the question. Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

As per the question, an administrator named Admin1 can manage LB1 and LB2. network contributor on LB1 and LB2 is correct. kindly suggest.

should contributor for LB1 as it is internal LB. Why give RG NW contributor? NW contributor for RG1 as LB2 is external and has a public IP that will belong to the RG.

Network Contributor Lets you manage networks, but not access to them. Permission include Microsoft.Network/* Create and manage networks, so Network contributor in both Actions Description Microsoft.Authorization/*/read Read roles and role assignments Microsoft.Insights/alertRules/* Create and manage a classic metric alert Microsoft.Network/* Create and manage networks Microsoft.ResourceHealth/availabilityStatuses/read Gets the availability statuses for all resources in the specified scope Microsoft.Resources/deployments/* Create and manage a deployment Microsoft.Resources/subscriptions/resourceGroups/read Gets or lists resource groups. Microsoft.Support/* Create and update a support ticket NotActions none DataActions none NotDataActions none

I tested it. Both are NW Contributor on RG1. If the user have the only for LB, failed to create error.

first Network contributor for RG1 2nd :Network contributor for RG1

Tested with my environment: First I assigned the user as a N/W contributor for both LB1 and LB2 which failed to create a backend pool or health probe... Next I assigned the N/W contributor role for both RG and I was able to create backend pools and health probe without any issues.. Answer is : Network Contributor on RG for both

should be network contributors on RG1 for both. I checked this on whizlab practise set as well, they have given the same answer . to add LB on Backend pool , user need to have access to VM Ips and Vnet. So NC on RG1 To setup probe , user need to have access to VM Public IP , so NC on RG1 is correct

in what role would you be where the only access you need is to add a backend pool or a health probe. Do companies really have so many people that they have people dedicated to just this? Answer is, I would google it to be sure at the time I need it.

I tested this out and N.C. was required on RG1 for the 1st one, N.C. on LB2 was required for the 2nd one.

Given answer is wrong. with Network admin on Load balancer , I was not able to create the Backend Pool. It just would not show the available Vnet. I tried giving it contributor/owner at LB level.It wont help. Needed to have Network contributor role at RG Level to be able to create BE Pool

100% Network Contributor on the RG for both.