You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains an Azure Cosmos DB database named DB1 and an Azure Kubernetes Service (AKS) cluster named AKS1. AKS1…

Question

Options

• AFor Sub1, assign the Owner role.
• BFor DB1, assign the Azure Cosmos DB Account Reader Role role.
• CFor RG1, assign the Azure Cosmos DB Data Reader Role role.
• DFor RG1, assign the Reader role.

• A
  4% (1)
• B
  85% (22)
• C
  8% (2)
• D
  4% (1)

Explanation

Option B is correct because assigning the Azure Cosmos DB Account Reader Role directly to DB1 gives AKS1's managed identity the minimum permissions needed to read from the Cosmos DB database - perfectly satisfying both the managed identity requirement and the principle of least privilege by scoping access to only the specific resource.

Why the distractors are wrong:

• Option A (Owner on Sub1) violates least privilege by granting full administrative control over the entire subscription, which is far broader than needed.
• Option C (Cosmos DB Data Reader on RG1) applies the role at the resource group level, which is broader than necessary - least privilege requires scoping to the specific resource (DB1), not the entire RG1.
• Option D (Reader on RG1) grants generic Azure resource management read access across the whole resource group, but the built-in Reader role does not grant data-plane access to Cosmos DB contents, making it both too broad in scope and insufficient in capability.

Memory Tip: Think "Right Role, Right Resource" - always match the most specific built-in role for the service (Cosmos DB Account Reader Role) to the exact resource (DB1), not a parent scope. If you see a role scoped to a subscription or resource group when a specific resource exists, it almost always violates least privilege.

No community discussion yet for this question.