A clerk’s office wants Foundry provisioned by Azure CLI, then access controls applied as a separate governed step. How should the pipeline be staged?
Select an answer to reveal the explanation.
Short Explanation
Stand the platform up, then hand out keys on purpose. You'll fail if you bootstrap Foundry with Azure CLI then issue access keys in a separate stage because you've swapped Entra-backed RBAC for shareable long-lived secrets. You'll also fail if you apply Azure Policy in that second stage because it's guardrails not access grants, and you'll fail if you assign Owner roles because that's far too broad for clerk personas.
Full Explanation
Bootstrapping Foundry with Azure CLI and then applying RBAC in a separate governed pipeline stage is the correct staging pattern for a clerk’s office that wants provisioning and access control as distinct steps. Separating create from grant improves auditability: the CLI (or equivalent IaC) creates the Foundry resource with a minimal default posture, and a later reviewed stage assigns Entra-backed roles to clerk GenAI personas. That split supports least privilege and produces pipeline evidence of who received which rights, and only after the resource already existed.
Bootstrapping Foundry with Azure CLI, then issuing access keys in a separate governed pipeline stage fails because access keys provide shareable long-lived secrets rather than Entra-backed RBAC and do not establish governed least-privilege role assignments for clerk GenAI personas. Bootstrapping Foundry with Azure CLI, then applying Azure Policy in a separate governed pipeline stage fails because Policy enforces compliance guardrails rather than assigning identity access, so it does not deliver the governed RBAC grants required as the separate access-control step. Bootstrapping Foundry with Azure CLI, then assigning Owner roles in a separate governed pipeline stage fails because Owner grants are excessively broad and violate least privilege for clerk personas, even though the timing is separate from creation and uses a governed stage.
Exam caveat: CLI bootstrap is an automation choice; the distinguishing GenAIOps idea here is sequencing—provision first, apply RBAC second under governance. Do not confuse this with networking or model-hosting questions that also mention Foundry.
Operational check: run the Azure CLI bootstrap in a non-interactive pipeline, confirm the Foundry resource exists with no broad Owner grants to end users, then apply the RBAC stage from reviewed code and verify clerk personas hold only intended roles.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.