You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
-> Reader
-> Security Admin
-> Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
Click on the arrows to vote for the correct answer
A. B. C. D.A
The correct answer is B. Assign User1 the Network Contributor role for VNet1.
Explanation:
In Azure, roles are used to grant permissions to users, groups, and applications. The roles can be assigned at different levels such as subscription, resource group, or resource level.
In this scenario, User1 has the Reader, Security Admin, and Security Reader roles at the subscription level. The Reader role provides read-only access to resources, while the Security Admin and Security Reader roles are related to security policies and monitoring.
To allow User1 to assign the Reader role for VNet1 to other users, User1 needs to have the necessary permissions to manage the virtual network. The Network Contributor role provides the necessary permissions to manage network resources, including virtual networks, subnets, and network interfaces.
Option A, Assign User1 the Owner role for VNet1: This option grants User1 full control over the virtual network and all resources associated with it. However, this is not the best option as it grants more permissions than necessary and could lead to potential security issues.
Option C, Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1: This option grants User1 the Contributor role at the subscription level, which provides the ability to create and manage resources, but not specifically the network resources.
Option D, Remove User1 from the Security Reader and Reader roles for Subscription1: This option removes the Reader and Security Reader roles from User1, but does not provide any additional permissions to manage network resources.
Therefore, the best option is B, Assign User1 the Network Contributor role for VNet1, as it provides the necessary permissions to manage the virtual network while minimizing the risk of granting unnecessary permissions.