Exam AZ-104 topic 2 question 77 discussion

Personally I think its YYN. 1) GROUP1 Reader access, provides access to view all items, except secrets https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#reader 2) To Assign OWNER role, you need to either Owner role or User Administrator Access Role https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-subscription-admin#prerequisites 3) Neither User Access Admin Role nor the Reader Role allows to create new resources. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps

So a User Access Administrator can't create new resource groups but they can assign a user with the Owner role, and the user with the Owner role *can* create new resource groups? I feel like Im missing something.

CORRECT

I"m going to say NYN here. No because even though the user has reader if you try to go and actually view the configuraiton of the function in the portal with this you don't see much. In fact what you do see is mostly an error or some fields that have names, but not any of their values and even the fields are wrong in most cases so N, the user needs a data level access perm to see the configuration itself. It can see the function for sure, it can see all of its data plane settings yes, but not its configuration. 2.) Y Because the user has User Access Administrator so can see it. 3.) N Because the user can't create a new resource group with those perms.

ChatGPT4 says all yes

All are YES / TRUE - vetted out by ChatGPT4 on 05/10/24 A - The Group1 members can view the configurations of the Azure functions. B - User1 can assign the Owner role for RG1. C - User1 can create a new resource group and deploy a virtual machine to the new group.

is just me or the information given about User didn't serve any purpose? the questions are only about User1

Given answer is right

Azure provides the following Azure built-in roles for authorizing access to App Configuration data using Microsoft Entra ID: Reader: Use this role to give read access to the App Configuration resource. This does not grant access to the resource's access keys, nor to the data stored in App Configuration. In short: Reader role is sufficient to view the configurations - just not the data that lives inside them.

This question was in exam 01/03/2024

Correct Yes Yes No

Was on exam 11/2 /2024

YYN 3.- Microsoft.Resources/subscriptions/resourceGroups/read Gets or lists resource groups. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor

People here are not paying attention to a clever wording of the question. "User1" and "User" are 2 different users. Read the question again. User1 is independent and User is a part of Group1. So YYN is true.

Answer YYN "The Group1 members can view the configurations of the Azure functions." - True. As Group1 members have Reader access at the management group level, they can view all resources in the management group, including the Azure functions in RG1. "User1 can assign the Owner role for RG1." - True. As a User Access Administrator for MG1, User1 can manage access to all resources in the management group. This includes assigning any role, including the Owner role, to any resource within MG1, which includes RG1. "User1 can create a new resource group and deploy a virtual machine to the new group." - False. The Virtual Machine Contributor role allows User1 to manage virtual machines, but it does not provide permissions to create new resource groups. Additionally, User Access Administrator and Reader roles do not grant permission to create resources or resource groups. To perform this task, User1 would need to be assigned a role with resource creation permissions, such as the Contributor role.

the answer is YYY. the last one is because user has Virtual Machine Contributor role, which is sufficient to create VM and resource group. It has "Microsoft.Resources/deployments/*"permission, see the docs: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor

Agree with YYN after reading MS articles and commends relating to them.