Examkin

Question

Difficulty: Very hardEntra ID Governance and Privileged Access

A digital payments processor is architecting a compliance and access framework for its cloud platform to align with PCI-DSS requirements. The security architecture team must enforce the following access policies:
- External compliance assessors require temporary, time-bound read access to subscription resources. This access must be restricted to a maximum window of four hours, require multi-factor authentication (MFA) upon elevation, and depend on explicit approval from the internal security lead.
- The administrative access footprint must be minimized, avoiding any permanent or standing assignment of privileged permissions to individual users or groups.
- Emergency break-glass accounts must be protected against service-level lockouts (such as an outage affecting the Entra ID multi-factor authentication service) while remaining under strict monitoring.
- All administrative role allocations must be audited regularly, with an automated mechanism to strip access if reviewers do not explicitly approve retention.

Which of the following actions should you recommend in the architectural design to meet these requirements? (Select THREE.)

  1. Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources, assigning a designated auditor security group as eligible for the Reader role with a maximum activation duration of four hours, requiring MFA and approval.Answer
  2. Exclude the emergency break-glass accounts from all Conditional Access policies that enforce multi-factor authentication, and monitor their login events using continuous log analytics alerting.Answer
  3. Establish Microsoft Entra Access Reviews for the privileged groups, and configure the fallback action to 'Remove access' to automatically revoke access if reviewers do not respond.Answer
  4. D
    Assign the Reader role eligibility directly to each auditor's individual Microsoft Entra user account within Privileged Identity Management (PIM) to maximize audit log precision.
  5. E
    Configure the auditor security group with an Active assignment type in Privileged Identity Management (PIM) to ensure continuous access is maintained during critical assessment periods.
  6. F
    Enforce a strict Conditional Access policy requiring multi-factor authentication for all administrative accounts, including emergency break-glass accounts, to eliminate any potential security gaps.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources with eligibility for the auditor group, exclude emergency break-glass accounts from MFA Conditional Access policies with continuous monitoring, and set Access Review fallback action to 'Remove access'.
The correct recommendations involve: configuring PIM for Azure resources with the auditor group as eligible to prevent standing access while requiring MFA and approval; excluding emergency break-glass accounts from Conditional Access MFA policies to prevent lockout during MFA outages while continuously monitoring them; and setting the access review fallback behavior to 'Remove access' to automate revocation of unreviewed permissions.

Step-by-Step Solution

1
Analyze the requirements for external compliance assessors who need time-bound read access.
Determine that a group-based Privileged Identity Management (PIM) eligible assignment with a 4-hour activation limit, requiring MFA and approval, satisfies this requirement.
This implements the principle of least privilege and just-in-time (JIT) access while minimizing administrative overhead.
2
Analyze the emergency break-glass account requirements.
Determine that these accounts must be excluded from Conditional Access MFA policies to avoid lockout during MFA outages, and their activity must be monitored using alerts.
Excluding emergency accounts from MFA is a critical safeguard against dependency lockouts, and monitoring ensures unauthorized use is immediately detected.
3
Analyze the auditing and automated revocation requirements.
Determine that Microsoft Entra Access Reviews with the 'Remove access' fallback option must be used.
This automates the cleanup of unreviewed or stale access permissions, maintaining a secure state.

Key Concept

Microsoft Entra ID Governance and Privileged Access Management (PIM) architecture, including JIT access, group-based assignment, emergency access mitigation, and automated access reviews.
Rate this question

Topics

Entra ID Governance and Privileged Access