SC-300 Question 34

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 3

  The correct answer is: Role1: Microsoft.App Role2: Microsoft.Security Explanation: Role1 requires permissions to create or delete instances of Azure Container Apps. The relevant resource provider for Azure Container Apps is Microsoft.App. This provider includes the necessary permissions to manage container app instances. Role2 needs to enforce adaptive network hardening rules, which are part of Azure Security Center's capabilities. The Microsoft.Security resource provider contains the permissions required to enforce adaptive network hardening and other security-related configurations. Resource Links: For more details on Azure resource providers and roles: Microsoft.App resource provider Microsoft.Security resource provider

• 4

  The answer here is wrong. It is Role 1: Microsoft.App, not compute - Given these options, here are the appropriate resource provider permissions for each role: Role1 (Create or delete instances of Azure Container Apps): Microsoft.App/containerApps/write: Allows creating or updating Azure Container Apps. Microsoft.App/containerApps/delete: Allows deleting Azure Container Apps. Role2 (Enforce adaptive network hardening rules): Microsoft.Security/adaptiveNetworkHardenings/write: Allows enforcing adaptive network hardening rules. Microsoft.Security/adaptiveNetworkHardenings/read: Allows reading adaptive network hardening rules. These permissions ensure that users assigned to Role1 can manage Azure Container Apps, while users assigned to Role2 can enforce network security rules effectively.

• 2

  To create custom roles that meet the specified requirements, you need to ensure the correct permissions are applied for each role. Role1: Create or delete instances of Azure Container Apps For Role1, users need permissions related to managing Azure Container Apps. The correct resource provider and permission are: Microsoft.App/containerApps/write: This permission allows users to create and delete Azure Container Apps instances. It provides the necessary capability for Role1. Role2: Enforce adaptive network hardening rules For Role2, users need permissions related to adaptive network hardening, which is part of Microsoft Defender for Cloud. The correct resource provider and permission are: Microsoft.Security/adaptiveNetworkHardenings/write: This permission allows users to enforce adaptive network hardening rules. It fits the requirement for Role2, providing users with the ability to manage these security rules. Summary: Role1: Microsoft.App/containerApps/write Role2: Microsoft.Security/adaptiveNetworkHardenings/write