Hotspot Question You need to recommend a solution to perform the network validation tasks for the platform upgrade. Which tool and role should you recommend for each user? To answer, select the…

Question

Explanation

This question tests your ability to match the correct network validation tool to a specific task and assign the appropriate RBAC role that grants only the necessary permissions - following the principle of least privilege during a platform upgrade.

Approach. For network validation tasks (such as verifying connectivity, diagnosing packet loss, or checking routing), the correct tool is typically Azure Network Watcher (or its sub-features: IP Flow Verify, Connection Monitor, Next Hop, or Packet Capture). The correct RBAC role must grant enough permission to run the tool without granting excessive access - for example, 'Network Contributor' can manage network resources, while 'Reader' can only view them. Assigning a role like 'Owner' or 'Contributor' at the subscription level would be incorrect because it violates least privilege. Each user should receive the most restrictive role that still allows them to complete their specific validation task (e.g., a user only running diagnostics needs 'Reader' or a custom role, not write access).

Concept tested. Azure Network Watcher tool selection and RBAC role assignment (least privilege principle) for network validation tasks during a platform upgrade

Reference. Microsoft Learn: Azure Network Watcher overview - https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview; Azure built-in roles for networking - https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#networking

No community discussion yet for this question.