AZ-900 Episode 28 - Practice Test

Best time to start was yesterday. The next best is NOW!

Practice Test

Question 1

Role definition represents a …

✔ That's correct
❌ That's not correct
👨‍🦱 💬 Role (role definition) is a collection of actions that the assigned identity will be able to perform on Azure resources.

Question 2

Colloquially Speaking role definition answers to a question …

✔ That's correct
❌ That's not correct
👨‍🦱 💬 Role definition is an answer to the question “What can be done?”

Question 3

Scope is a … that the access is applied to.

✔ That's correct
❌ That's not correct
👨‍🦱 💬 A Scope is one or more Azure resources that the access applies to.

Question 4

Security Principal objects (identities) can represent. Choose 4.

✔ That's correct
❌ That's not correct
👨‍🦱 💬 Security Principal is an Azure object (identity) that can be assigned to a role (ex. users, groups or application/service objects like service principals, or managed identities).

Question 5

Role assignment represents a …

✔ That's correct
❌ That's not correct
👨‍🦱 💬 Role assignment is a combination of the role definition, security principal, and scope.

Question 6

Colloquially Speaking scope assignment answers to a question …

✔ That's correct
❌ That's not correct
👨‍🦱 💬 Scope assignment is an answer to the question “Where can it be done?”

Question 7

Colloquially Speaking service principal assignment answers to a question …

✔ That's correct
❌ That's not correct
👨‍🦱 💬 Security Principal assignment is an answer to the question “Who can do it?”

Question 8

RBAC is an authorization system built on Azure Resource Manager. True or false?

✔ That's correct
❌ That's not correct
👨‍🦱 💬 Azure RBAC is an authorization system built on Azure Resource Manager that provides fine-grained access management of Azure resources.

Question 9

Scope can be a …

✔ That's correct
❌ That's not correct
👨‍🦱 💬 A Scope can be applied to any Azure Resource Manager (ARM) governed object. So it includes management groups, subscriptions, resource groups, and individual resources.

Question 10

What is the proper order of actions that must be taken to grant a role in Azure Portal
A. Click Add Role Assignment button
B. Open Access Management (IAM) blade
C. Navigate to Azure resource, resource group, subscription, or management group
D. Click Save button
E. Select Role and Sercurity Principal

✔ That's correct
❌ That's not correct
👨‍🦱 💬 C > B > A > E > D is the proper order. You need to navigate to a resource for which you want to assign permissions and open access control blade (this will be your scope). Then you need to select add role assignment button and select user/group and/or application and a role definition. And finish by clicking on the save button.

Question 11

Jessica works for Contoso company as an Azure administrator. As part of her role, she needs to be able to view all Azure resources in the Azure subscription called AZ-SUB-01. But additionally, she needs to be able to perform any actions on a resource group named AZ-ADMIN-RG within that subscription. What is the best strategy to grant her appropriate privileges to perform her tasks?

✔ That's correct
❌ That's not correct
👨‍🦱 💬 In order to view all resources on Azure subscription, Jessica will need a reader role applied to the scope of the entire subscription AZ-SUB-01. In order to allow full access to Jessica on a specific resource group, she needs to be granted another role, in this case, owner role to allow her full access on the AZ-ADMIN-RG resource group

Question 12

Contoso company wants to allow their development team to deploy web application to Azure App Service. What is the best strategy to do this following least-privilege required principle and that requires the least amount of effort?
Hint: All specified roles allow for web app deployments.

✔ That's correct
❌ That's not correct
👨‍🦱 💬 A Website Contributor role is much less privileged than an Owner as it’s only targeting Azure Websites. So this role should be our priority. The Creation of Azure AD group will reduce maintenance and role assignment effort by having to do it only once for entire group. Applying the role to a specific Azure App Service ensures that the developers have access only to the target app service. If applied on resource group level developers would have access to other app services in that group too.
◀ Previous Episode Next Episode ▶

Adam Marczak

Programmer, architect, trainer, blogger, evangelist are just a few of my titles. What I really am, is a passionate technology enthusiast. I take great pleasure in learning new technologies and finding ways in which this can aid people every day. My latest passion is running an Azure 4 Everyone YouTube channel, where I show that Azure really is for everyone!

Did you enjoy the article?

Share it!

More tagged posts