Exam AZ-104 topic 2 question 64 discussion

C. Assign the Website Contributor role to the developers. To allow the developers of App1 to use their Azure AD credentials to deploy content to App1 using Web Deploy, you should assign the Website Contributor role to the developers. This role provides the necessary permissions for developers to deploy content to the web app, but does not grant them excessive permissions that could be used to make unwanted changes. Option A is not recommended as it would grant excessive permissions to the developers, which could be used to make unwanted changes. Option B and D are not relevant to the scenario as the question is specifically asking for how to use Azure AD credentials for Web Deploy, not FTPS. Option C is a potential solution, but the Website Contributor role provides a more targeted and appropriate level of permissions for the scenario.

B is wrong because: "To secure app deployment from a local computer, Azure App Service supports two types of credentials for local Git deployment and FTP/S deployment. These credentials are not the same as your Azure subscription credentials." https://learn.microsoft.com/en-us/azure/app-service/deploy-configure-credentials?tabs=cli Correct is C. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#website-contributor Microsoft.Resources/deployments/* - Create and manage a deployment

it´s C

Answer is C: The app-level credentials for FTPS do not allow deployment of content to an Azure App Services web app using Azure AD credentials.

Based on the information from the Azure documentation, the best solution is: C. Assign the Website Contributor role to the developers Here's why: The Website Contributor role allows developers to manage websites, but not the underlying web plans. This adheres to the principle of least privilege by granting the minimum permissions needed to deploy the web app. Some key points about the Website Contributor role: It allows creating and managing websites Developers can deploy content to websites they have access to It does not allow managing the App Service plans or assigning roles to others

was in the exam today 17/06/2024

on exam today 6/6/2024

C. Assign the Website Contributor role to the developers This role provides the necessary permissions for developers to deploy content to App1 using Web Deploy, adheres to the principle of least privilege by restricting permissions to what is needed for web deployment, and integrates with Azure AD for authentication.

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/web-and-mobile#website-contributor

Passed AZ-104 today 03/07/24 879%. 99% of Examtopics questions in my test with exact same wording. This question was on the test, I answered C. Very Thanks to Examtopics.

I dont think it is C, as the role says: { "assignableScopes": [ "/" ], "description": "Lets you manage websites (not web plans), but not access to them.", "id": "/providers/Microsoft.Authorization/roleDefinitions/de139f84-1756-47ae-9be6-808fbbe84772", "name": "de139f84-1756-47ae-9be6-808fbbe84772", part of question is to ensure devs can use creds, so I think this is related to that. also dont see in JSON the append or modify action.

I beleve B is correct. https://learn.microsoft.com/en-us/azure/app-service/deploy-ftp?tabs=portal

C is correct

The correct answer is: C. Assign the Website Contributor role to the developers. Explanation: Assigning the Website Contributor role to the developers would grant them the necessary permissions to deploy content to the Azure App Services web app (App1) without giving them excessive privileges. This role provides the necessary permissions for managing the website, including deployment, without granting ownership or administrative rights, thus adhering to the principle of least privilege.

100% C is correct

https://learn.microsoft.com/en-us/azure/app-service/deploy-configure-credentials?tabs=cli from what I see you need to be a contributor anyway for app-level (FTPS) and question is saying least possible access, so contributor anyway, this is how I understand

Selected Answer: C The solution must use the principle of least privilege. Website Contributor role with the exact permission: Microsoft.Resources/deployments/* => Create and manage a deployment