Examkin

Question

Difficulty: HardAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance and access model for a new division. The division will use a dedicated Azure subscription under the corporate management group. You need to design an identity and access management solution that meets the following security and operational guidelines:

* Database administrators (DBAs) must be able to manage Azure SQL databases, but they should only have these privileges when active on-call or working on an assigned incident.
* Auditor accounts must be able to view all resource configurations across the subscription but must not be allowed to modify any settings.
* All administrative privileges must be audit-compliant, scalable, and follow the principle of least privilege.
* Virtual machine deployments must automatically have a monitoring agent installed without requiring manual intervention by developers.

Which of the following configuration options should you include in the design? (Select THREE.)

  1. Configure a Microsoft Entra ID security group for the database administrators, and assign this group eligible access to the SQL Server Contributor role using Privileged Identity Management (PIM) at the subscription scope.Answer
  2. Create a Microsoft Entra ID security group for the auditors, and assign this group the Reader role at the subscription scope.Answer
  3. Assign an Azure Policy definition with the DeployIfNotExists effect at the subscription scope to automatically install the monitoring agent on newly deployed virtual machines.Answer
  4. D
    Assign the SQL Server Contributor role directly to individual database administrator user accounts within the subscription to ensure audit logs track individual activity.
  5. E
    Configure the Privileged Identity Management (PIM) assignments for the database administrator security group as permanently active to eliminate login latency during critical database incidents.
  6. F
    Deploy an Azure Policy with the Deny effect to block the deployment of any virtual machines that do not contain the monitoring agent configuration in their deployment template.

Answer

Configure a Microsoft Entra ID security group for database administrators and assign it eligible access to the SQL Server Contributor role via PIM; assign the Reader role to a group for auditors at the subscription scope; and deploy an Azure Policy with the DeployIfNotExists effect to automatically install the monitoring agent.
The correct options ensure governance aligns with scalable management and security. Eligible PIM group assignments grant temporary database administrator access only when required. A Reader role group assignment delegated at the subscription level provides read-only auditor access. DeployIfNotExists Azure Policy automatically remediates compliance by deploying the monitoring agent.

Step-by-Step Solution

1
Evaluate the database administrator requirement for temporary access.
Identify that Privileged Identity Management (PIM) eligible role assignments for a group provide just-in-time administrative access, meeting audit and least-privilege requirements without standing permissions.
Security best practices demand that privileged roles are not permanently assigned, and administration must scale via groups.
2
Evaluate the auditor requirement for read-only access.
Identify that the built-in Reader role assigned to a Microsoft Entra ID security group at the subscription scope provides read-only visibility to all resources.
Reader is the standard role for viewing resource metadata without modification capabilities, and assigning it to a group satisfies governance requirements.
3
Evaluate the automatic monitoring agent installation requirement.
Determine that an Azure Policy with the DeployIfNotExists effect can deploy the agent extension during VM creation if it is missing.
DeployIfNotExists automatically remediates non-compliant resources, ensuring compliance without forcing manual deployment by developers.

Key Concept

Azure RBAC, Subscription Governance, PIM role assignment strategies, and Azure Policy remediation effects.
Rate this question

Topics

Azure RBAC and Subscription Governance