Exam AZ-104 topic 6 question 26 discussion

For Me N,Y,Y. Microsoft.Compute/virtualMachines/* Perform all virtual machine actions including create, update, delete, start, restart, and power off virtual machines. Execute scripts on virtual machines.

N - ms.auth/*/write is NOT allowed. Y - ms.comp/vm/* is allowed. Y - ms.net/netint/* is allowed.

Y,N,Y The hard one is #2 and you don't have the following to write to a resource group: Microsoft.Resources/subscriptions/resourceGroups/write

You can argue that 2 is no because you need to write to a resource group and this doesn't exist: Microsoft.Resources/subscriptions/resourceGroups/write

Users that are assigned to Role1 can assign Role1 to user = No ( notAction = Authorization/elevateAccess/Action ) User that are assigned Role1 can deploy new virtual machine = Yes ( action = Compute/virtualMachine/* ) Users that are assigned in Role1 can set a static IP address to a virtual machine = Yes ( action = Network/networkinterface/* )

should be N,Y,Y

N-Y-Y Users that are assigned Role1 can assign Role1 to users: no, because "Microsoft.Authorization/elevateAccess/Action" is under "notAction". Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions#notactions Users that are assigned Role1 can deploy new virtual machines: yes, because onder "actions" we have "Microsoft.Resources/deployments/*". Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#virtual-machine-contributor Users that are assigned Role1 can set a static IP address on a virtual machine: yes, because onder "actions" we have "Microsoft.Network/networkinterfaces/*". Source: https://docs.metallic.io/metallic/azure_resource_provider_usage.html

I think the answer is No-No-Yes. The key word is “notAction” It says Role1 can not do these: “notAction”: [ “Microsoft.Authorization/*/Delete”, “Microsoft.Authorization/*/Write”, “Microsoft.Authorization/elevateAccess/Action” I say Yes to Role1 can set a static IP address on a virtual machine, because it does not say you can not do it in "notAction"

No Yes Yes

Users that are assigned Role1 can assign Role1 to users: No (due to a lack of specific roleAssignments permissions and notActions restrictions). Users that are assigned Role1 can deploy new virtual machines: Yes (supported by "Microsoft.Compute/virtualMachines/*"). Users that are assigned Role1 can set a static IP address on a virtual machine: Yes (supported by "Microsoft.Network/networkInterfaces/*").

N Y Y is correct!

Box 1: N Because doesn't have: Microsoft.Authorization/*/Write - Create roles, role assignments, policy assignments, policy definitions and policy set definitions Box 2; Yes Has been assigned; Microsoft.Compute/virtualMachines/* - Perform all virtual machine actions including create, update, delete, start, restart, and power off virtual machines. Execute scripts on virtual machines. Box 3: Y Has been assigned; Microsoft.Network/networkInterfaces/* - Create and manage network interfaces See; https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

I think it should be NNY. The user cannot assign to the role1 other users since ms.auth/*/write is not allowed. The user cannot create a VM since she is a reader at the RG level. The user with the Reader role on a resource group does not have permission to create a virtual machine (VM) within that resource group. The Reader role is a read-only role that only allows the user to view the resources and their configurations within the resource group. However, she can modify the IP address of the existing VM because she is a VM Contributor.

Correct answer is N, Y, Y

The correct answer is N, Y, Y

isn't dataactions needed to create virtualmachines ?

A misleading question that tests your ability to parse JSON more than anything else. The JSON value "Microsoft.Compute/virtualMachines/* gives the user with role1 the ability to perform all actions, including the ability create virtual machines. Any actions that are described by this wildcard, including /start, /deallocate, etc are not necessary to add the role. They are simply noise that is deliberately inserted to confuse the reader. Inserting noise in exhibits is a favourite tactic to lead people to an incorrect response.