Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance and access strategy for its multi-region Azure environment. The environment uses a management group hierarchy to segregate production and development workloads.

The design must satisfy the following requirements:
- A central security team must be able to view all resource configurations, including Network Security Groups (NSGs), across all subscriptions under the production management group.
- The members of the security team must only have read access when performing active audit tasks, and their access must be granted temporarily on-demand.
- New resource groups created in the production subscriptions must automatically be configured with a delete resource lock, without blocking the resource group creation process itself.

Which of the following configurations should you recommend in the governance design?

  1. A
    Configure an eligible role assignment for each individual security team member to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.
  2. Create a Microsoft Entra ID security group containing the security team members. Configure an eligible role assignment for the group to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.Answer
  3. C
    Create a Microsoft Entra ID security group containing the security team members. Configure a permanently active role assignment for the group to the Reader role at the production management group level. Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.
  4. D
    Create a Microsoft Entra ID security group containing the security team members. Configure an eligible role assignment for the group to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the Deny effect at the production management group level to block the creation of resource groups that do not have the delete resource lock.

Answer

Create a Microsoft Entra ID security group containing the security team members. Configure an eligible role assignment for the group to the Reader role at the production management group level using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect at the production management group level to apply the delete resource locks.
The correct configuration uses a Microsoft Entra ID security group to simplify role administration, rather than assigning permissions to individual users. To enforce the principle of least privilege and satisfy the requirement for temporary access during audits, the group is configured with an eligible Reader role assignment at the management group scope using Privileged Identity Management (PIM). To automatically apply delete resource locks without interrupting resource group deployments, an Azure Policy with the DeployIfNotExists effect is deployed, which remediates non-compliant resource groups post-deployment.

Step-by-Step Solution

1
Define the identity mapping strategy for the security team members.
Group all security team members into a Microsoft Entra ID security group.
Assigning roles to groups instead of individual users ensures administrative scalability and aligns with Azure identity best practices.
2
Configure the RBAC role assignment and scope.
Assign the group an eligible role assignment to the Reader role at the production management group level using Privileged Identity Management (PIM).
Reader permission provides read-only visibility into NSGs and other resources. Assigning it at the management group level ensures inheritance to all child subscriptions. The eligible assignment satisfies the requirement for temporary on-demand access.
3
Design the automated lock deployment mechanism.
Deploy an Azure Policy at the production management group level with a DeployIfNotExists effect targeting resource groups without a delete lock.
The DeployIfNotExists effect automatically creates the delete resource lock after the resource group is created, satisfying the requirement to enforce locks without blocking the initial deployment.

Key Concept

Designing subscription governance using Azure Policy, PIM, and RBAC groups.
Rate this question

Topics

Azure RBAC and Subscription Governance