Examkin

Question

Difficulty: HardAzure RBAC and Subscription Governance

A financial services corporation is establishing a new multi-region environment under a single tenant. The environment is organized under a root-level management group named Enterprise-Core-MG. To comply with regulatory standards, the corporation must enforce two governance policies across all existing and future subscriptions:

1. A specific diagnostic setting must be automatically configured on all subscriptions to forward activity logs to a centralized Log Analytics workspace in the security subscription.
2. A delegated team of operations engineers must be granted the ability to create and manage virtual machines within all subscriptions, without allowing them to modify subscription-level access controls or delete the centralized logging configurations.

Which design configuration should you recommend to meet the requirements while minimizing administrative overhead?

  1. Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Create a Microsoft Entra ID security group, add the operations engineers to the group, and assign the Virtual Machine Contributor role to the group at the Enterprise-Core-MG scope.Answer
  2. B
    Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Assign the Virtual Machine Contributor role directly to the individual Microsoft Entra ID user accounts of each operations engineer at the Enterprise-Core-MG scope.
  3. C
    Deploy an Azure Policy definition with the Deny effect at the Enterprise-Core-MG scope to block subscription operations that lack the diagnostic settings. Create a Microsoft Entra ID security group, add the operations engineers to the group, and assign the Virtual Machine Contributor role to the group at the Enterprise-Core-MG scope.
  4. D
    Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Configure Microsoft Entra Privileged Identity Management (PIM) to assign the Virtual Machine Contributor role at the Enterprise-Core-MG scope to each operations engineer as a permanently active assignment.

Answer

Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Create a Microsoft Entra ID security group, add the operations engineers to the group, and assign the Virtual Machine Contributor role to the group at the Enterprise-Core-MG scope.
The correct configuration uses Azure Policy with the deployIfNotExists effect applied at the management group level, which ensures that all child subscriptions automatically configure the diagnostic settings. Additionally, it adheres to the principle of least privilege and simplifies management by assigning the Virtual Machine Contributor role to a Microsoft Entra ID security group at the management group level rather than directly to individual users.

Step-by-Step Solution

1
Define the compliance enforcement mechanism for diagnostic settings.
Identify that Azure Policy with the deployIfNotExists effect at the Enterprise-Core-MG scope ensures automatic remediation and configuration of diagnostic settings on all present and future subscriptions.
This automates compliance without blocking deployment workflows or requiring manual configuration.
2
Group operations engineers to manage identity efficiently.
Create a single Microsoft Entra ID security group containing the operations engineers.
Grouping identities reduces administrative overhead and enables scalable access control instead of managing individual role assignments.
3
Assign the Virtual Machine Contributor role to the security group at the management group scope.
The role assignment inherits down to all subscriptions within the management group, providing the operations team with permissions to manage virtual machines without owner-level privileges.
This satisfies the least privilege requirement and ensures the team cannot modify subscription-level access controls or delete central configuration resources.

Key Concept

Combining management group-scoped Azure Policy remediation with group-based RBAC assignments to achieve automated subscription compliance and delegated least-privilege administration.
Rate this question

Topics

Azure RBAC and Subscription Governance