StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Hybrid multicloud posture and exposure

Practice question 256 of 498 · hard

A company grants its enrollment automation Owner on the entire subscription. It only needs to connect servers. What should the architect change?

Choose the single best answer.

  1. A.Grant Contributor at the same scope and keep enrollment and administration together
  2. B.Retain Owner because registration requires unrestricted extension administration
  3. C.Grant Reader at the target resource group and expect server registration to succeed
  4. D.Use narrowly scoped onboarding permissions and separate later host-administration roles
Show the answer and explanation

✓ Correct answer

  • Use narrowly scoped onboarding permissions and separate later host-administration roles

Use scoped onboarding permissions and separate later administration. Owner and Contributor contain powers beyond enrollment, including sensitive management actions. Reader is insufficient to create the Arc resource. The role should match the operation rather than default to a broad administrator or a read-only role.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.