Summer interns need limited rights on one parks-and-recreation resource group. Which RBAC practice best follows least privilege?
Select an answer to reveal the explanation.
Short Explanation
Least privilege is "the smallest key for the smallest room." Interns get a narrow role on one resource group—not Owner of the whole subscription. Big keys for tiny jobs are how accidents happen.
Full Explanation
Least privilege for summer interns means granting only the rights required for parks-and-recreation work, at the narrowest practical scope. Assigning a constrained role—such as Reader or a more specific built-in/custom role—at the parks-and-recreation resource group keeps intern influence inside that boundary instead of across the entire municipal subscription. Avoiding Owner at subscription scope prevents accidental or malicious changes to unrelated departments’ resources and simplifies offboarding when the internship ends.
Owner at the entire subscription maximizes blast radius and contradicts least privilege. Sharing the global administrator password—even temporarily—collapses identity accountability and far exceeds intern needs. Disabling RBAC and allowing anonymous Contributor access from the internet removes authentication and authorization safeguards entirely and is never acceptable municipal practice.
Exam caveat: scope matters as much as role name—Reader at subscription can still be broader than Contributor at a single resource group depending on what the scenario actually requires; match both role and scope to the task.
Operational check: create an Entra group for interns, assign the narrow role only on the parks resource group, verify members cannot modify other resource groups, and schedule removal of the group membership on the internship end date.