Hotspot Question You have an Azure subscription that contains a user named User1 and the resources shown in the following table. NSG1 is associated to networkinterface1. User1 has role assignments…

Question

Exhibits

Answer Area

• User1 can create a storage account in RG1.Yes
• User1 can modify the DNS settings of networkinterface1.No
• User1 can create an inbound security rule to filter inbound traffic to networkinterface1.Yes

Explanation

User1 has a Contributor role on NSG1, which is scoped to the NSG1 resource itself, but the Contributor role at the Resource Group (RG1) level allows creating new resources like storage accounts within that resource group. Since NSG1 is associated with networkinterface1 (not the other way around), User1's permissions on NSG1 do not extend to modifying networkinterface1's DNS settings - those require permissions on the network interface resource itself. However, because User1 has Contributor access to NSG1, they can fully manage NSG1's inbound security rules, which filter traffic to any associated network interface including networkinterface1.

No community discussion yet for this question.