You have an Azure subscription that contains a user named User1.
You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege.
Which role-based access control (RBAC) role should you assign to User1?
Click on the arrows to vote for the correct answer
A. B. C. D.B
Virtual Machine Contributor: Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.
Incorrect Answers:
A: Owner: Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.
C: Contributor: Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC.
D: Virtual Machine Administrator Login: View Virtual Machines in the portal and login as administrator.
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-rolesThe principle of least privilege is a security concept that states that users should be granted the minimum level of access necessary to perform their required tasks. Based on this concept, the RBAC role that should be assigned to User1 to ensure they can deploy virtual machines and manage virtual networks with minimum privileges is Virtual Machine Contributor.
Explanation of each option:
A. Owner: An owner can manage all aspects of a subscription, including access management. Granting this role to User1 would give them complete control over the subscription, which is more access than necessary and violates the principle of least privilege.
B. Virtual Machine Contributor: This role allows users to manage virtual machines but not to manage the Azure resources they run on. This is the appropriate role to assign to User1 since they only need to deploy virtual machines.
C. Contributor: This role allows users to manage all Azure resources except for access management. It is more access than necessary for User1 since they only need to deploy virtual machines and manage virtual networks.
D. Virtual Machine Administrator Login: This role allows users to manage virtual machines, including resetting passwords and managing operating system updates. It is more access than necessary for User1 since they do not need to manage the operating systems on the virtual machines.