Exam AZ-301 topic 2 question 23 discussion

Actual exam question from Microsoft's AZ-301

Question #: 23
Topic #: 2

Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains a resource group named RG1.
You create an Azure Active Directory (Azure AD) group named ResearchUsers that contains the user accounts of all researchers.
You need to recommend a solution that meets the following requirements:
✑ The researchers must be allowed to create Azure virtual machines.
✑ The researchers must only be able to create Azure virtual machines by using specific Azure Resource Manager templates.
Solution: On RG1, assign a custom role-based access control (RBAC) role to the ResearchUsers group.
Does this meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: B 🗳️
Instead: On RG1, assign the Contributor role to the ResearchUsers group. Create a custom Azure Policy definition and assign the policy to RG1.

by Jake__ at Nov. 4, 2019, 8:27 p.m.

Comments

Submit Cancel

pradjhun

Highly Voted 5 years, 6 months ago

But the challenge with custom role is that it will not enforce use to use template only.. That can we only enforce using Azure policy

upvoted 20 times

...

Jake__

Highly Voted 5 years, 7 months ago

Considering we do not know what the Custom RBAC role is, you cant determine if it will work or not. Custom roles can give you any access available, including giving access equal to or more than the contributor role. This question makes no sense how we would know what this customer role is. Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles

upvoted 5 times

5 years ago

ANswer is should be Yes. As we can also assign custom role necessary scopes and permissions. The Contributor role is not only the solution.

upvoted 1 times

5 years, 2 months ago

The Answer should be YES as the exiting Contributor roles satisfy the requirement even using the RM templates.

upvoted 1 times

Rajuuu

5 years, 2 months ago

Please ignore ,,,Answer is No

upvoted 3 times

...