Exam AZ-104 topic 2 question 34 discussion

Correct Answer: A Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

correct answer

Correct answer is A

The owner can enable but is it the "required" role if we take into account least privilege principle

Respuesta Correcta

A is correct Owner & Network Contributor can enable Traffic Analytics

A is correct

Answer B - The key word that indicates that the answer B is correct is "enable." The goal is to ensure that an Azure AD user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. This implies that the user needs permissions to configure or activate Traffic Analytics, not just view or read its data. Therefore, simply assigning the Reader role, which provides read-only access, does not fulfill the requirement to enable Traffic Analytics.

Yes is right

Copilot: No, assigning the Owner role to Admin1 does not meet the goal of enabling Traffic Analytics for an Azure subscription. The Owner role provides full control over the entire subscription, including resources and access management. However, it is not specific to enabling or configuring Traffic Analytics. To achieve the goal, you should assign a role that specifically grants permissions related to Traffic Analytics, such as the Log Analytics Contributor role. This role allows users to manage and configure Log Analytics workspaces, which includes enabling features like Traffic Analytics. Therefore, consider assigning the Log Analytics Contributor role to Admin1 to meet the goal effectively.

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics#prerequisites https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.

A. Yes Assigning the Owner role at the subscription level to Admin1 meets the goal of enabling Traffic Analytics for an Azure subscription. The Owner role has full access to all resources within the subscription, including the ability to enable Traffic Analytics. By assigning the Owner role to Admin1 at the subscription level, Admin1 will have the necessary permissions and control to enable and configure Traffic Analytics for the Azure subscription. Therefore, the provided solution meets the goal.

Yes. A is correct. Owner have full access to resources.

No, assigning the Network Contributor role at the subscription level to Admin1 does not meet the goal of enabling Traffic Analytics. The Network Contributor role provides the ability to manage network resources, but it does not include the necessary permissions to configure Traffic Analytics. To enable Traffic Analytics, Admin1 needs to be assigned the Network Contributor role on the resource group where the virtual network that is being monitored by Traffic Analytics is located, and also needs to have read permissions to the storage account where the Traffic Analytics data is stored.

Correct