An auditor at a pharmaceutical company is reviewing a storage account. The company assigned the compliance team's Reader role at the management group level and assigned an allowed-regions policy at the subscription level. The auditor wants to know which of these assignments affect the storage account. Which statement is correct?

1. A. Both affect it: role assignments and policies from higher scopes are inherited by the resource groups and resources beneath them ✓ A
2. B. Only the policy applies, because role assignments made at a management group level never reach down to individual resources 💬 B
3. C. Only the role assignment applies, because policies are enforced solely at the scope where they were assigned 💬 C
4. D. Neither applies until the storage account's resource group is explicitly added to both assignments 💬 D

Revelar gabarito

Resposta correta: Both affect it: role assignments and policies from higher scopes are inherited by the resource groups and resources beneath them

Referência: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/overview