Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance and access model for a new business unit. The unit will use three Azure subscriptions managed under a single parent management group named Corp-Unit-MG.

You must meet the following requirements:
1. Allow a team of database administrators (DBAs) to manage all Azure SQL databases across all three subscriptions.
2. Ensure that any new Azure SQL Database deployed in these subscriptions is automatically configured to send diagnostic logs to a central Log Analytics workspace, without blocking deployment or requiring manual configuration by the DBAs.
3. Minimize administrative overhead and adhere to the principle of least privilege.

Which solution should you recommend?

  1. A
    Create a Microsoft Entra ID security group containing all DBAs. Configure Microsoft Entra Privileged Identity Management (PIM) with a permanently active assignment for the SQL DB Contributor role to the group at the Corp-Unit-MG scope. Assign an Azure Policy with a DeployIfNotExists effect at the Corp-Unit-MG scope to deploy the database diagnostic settings.
  2. B
    Assign the SQL DB Contributor role directly to the individual database administrator user accounts at the Corp-Unit-MG management group scope. Assign an Azure Policy with a DeployIfNotExists effect at the Corp-Unit-MG scope to deploy the database diagnostic settings.
  3. Create a Microsoft Entra ID security group containing all DBAs. Assign the SQL DB Contributor role to the group at the Corp-Unit-MG management group scope. Assign an Azure Policy with a DeployIfNotExists effect at the Corp-Unit-MG scope to deploy the database diagnostic settings.Answer
  4. D
    Create a Microsoft Entra ID security group containing all DBAs. Assign the SQL DB Contributor role to the group at the Corp-Unit-MG management group scope. Assign an Azure Policy with a Deny effect at the Corp-Unit-MG scope to block the deployment of any Azure SQL Database that does not have diagnostic settings configured.

Answer

Create a Microsoft Entra ID security group containing all DBAs, assign the SQL DB Contributor role to the group at the management group scope, and assign a DeployIfNotExists Azure Policy at the management group scope to automatically deploy the database diagnostic settings.
The correct solution leverages a Microsoft Entra ID security group assigned the SQL DB Contributor role at the parent management group level, combined with a DeployIfNotExists Azure Policy. Using a security group simplifies identity lifecycle management, and assigning it at the management group scope ensures inheritance across all subscriptions. The DeployIfNotExists policy automatically configures diagnostic settings to send logs to the Log Analytics workspace upon creation without blocking the database deployment.

Step-by-Step Solution

1
Select the appropriate RBAC identity assignment method.
Identify that the DBAs should be placed in a Microsoft Entra ID security group instead of assigning roles to individual accounts to minimize overhead.
Direct user assignments do not scale and violate Azure subscription governance best practices.
2
Determine the optimal RBAC scope and role.
Assign the SQL DB Contributor role to the security group at the parent management group (Corp-Unit-MG) scope.
Assigning at the management group level ensures automatic inheritance to all three subscriptions, and the SQL DB Contributor role enforces least privilege.
3
Identify the correct Azure Policy effect to enforce auditing.
Select the DeployIfNotExists policy effect instead of a Deny effect.
The DeployIfNotExists effect automatically applies the diagnostic settings during or after deployment without interrupting or blocking the deployment itself.

Key Concept

Azure RBAC inheritance and automated subscription governance using DeployIfNotExists policies.
Estimated Time:2m 0s
Rate this question

Topics

Azure RBAC and Subscription Governance