Hotspot Question You have an Azure subscription named Subscription1 that contains a resource group named RG1. In RG1, you create an internal load balancer named LB1 and a public load balancer named…

Question

Exhibits

Answer Area

• To add a backend pool to LB1:
  Contributor on LB1Network Contributor on LB1Network Contributor on RG1Owner on LB1
• To add a health probe to LB2:
  Contributor on LB2Network Contributor on LB2Network Contributor on RG1Owner on LB2

Explanation

Assigning the Network Contributor role at the resource group level (RG1) adheres to the principle of least privilege for managing network resources like load balancers, including configuring backend pools and health probes, as it covers all necessary networking operations within that scope.

Approach. The correct interaction is to select 'Network Contributor on RG1' for both tasks. This choice aligns with the principle of least privilege while providing sufficient permissions for the specified operations.

1. To add a backend pool to LB1: Adding a backend pool involves configuring the load balancer and associating virtual machine network interfaces (NICs) with that pool. The Network Contributor role grants comprehensive permissions to manage all network resources, including load balancers (Microsoft.Network/loadBalancers/*) and crucially, the ability to join network interfaces to load balancer backend pools (Microsoft.Network/networkInterfaces/join/action). By assigning Network Contributor at the RG1 scope, Admin1 gains the necessary permissions over LB1 and any virtual machine NICs within RG1 that need to be added to the backend pool. This ensures Admin1 can perform the entire operation without needing additional role assignments on individual NICs, and it's still restricted to only network resources within RG1.

2. To add a health probe to LB2: A health probe is a configuration property directly on the load balancer resource itself. The Network Contributor role, when assigned at the RG1 scope, provides full management capabilities over LB2 (since LB2 is in RG1), which includes configuring health probes (Microsoft.Network/loadBalancers/probes/*). While 'Network Contributor on LB2' would also suffice for this specific task, selecting 'Network Contributor on RG1' for both tasks offers a consistent and practical least-privilege solution for an administrator who needs to manage multiple network resources (like LB1 and LB2) within a specific resource group. It grants only the necessary network permissions within that defined scope, covering all aspects of load balancer management shown in the question.

Common mistakes.

• common_mistake. 1. Contributor on LB1 / Contributor on LB2: The 'Contributor' role provides full management access to all types of resources within its scope (e.g., compute, storage, network), not just networking. This violates the principle of least privilege because Admin1 only needs to manage network resources.

1. Owner on LB1 / Owner on LB2: The 'Owner' role grants complete control, including the ability to assign roles to others. This is an extreme violation of the principle of least privilege and would grant far more access than required for these tasks.
2. Network Contributor on LB1 (for backend pool): While 'Network Contributor' is the correct type of role, assigning it only to LB1 might be insufficient if the backend pool creation requires permissions on the network interfaces of the VMs being added to the pool, and those NICs are considered distinct resources from LB1 itself. The Microsoft.Network/networkInterfaces/join/action permission is often needed for this, and assigning Network Contributor at the Resource Group scope ensures this permission is available for all relevant NICs within RG1.
3. Network Contributor on LB2 (for health probe): This would technically work for the health probe task. However, the question implies 'managing LB1 and LB2'. Providing a single Network Contributor on RG1 role covers both tasks adequately with least privilege within the scope of network resources in RG1, which is a common and efficient approach in Azure RBAC.

Concept tested. Azure Role-Based Access Control (RBAC), Principle of Least Privilege, understanding of built-in Azure roles (specifically the 'Network Contributor' role), and knowledge of Azure Load Balancer components (backend pools and health probes) and the specific permissions required to configure them.

No community discussion yet for this question.