Examkin

Question

Difficulty: HardAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance and access control strategy for a multi-region Azure environment. The environment is organized under a root-level management group containing two child management groups: Production-MG and Development-MG.

The operations team has the following requirements:
1. Security auditors must be able to view the configuration of all resources across all subscriptions under Production-MG at all times.
2. A team of site reliability engineers (SREs) requires temporary administrative permissions on virtual machines inside Production-MG subscriptions only when responding to active incidents.
3. Any virtual machine deployed in Production-MG subscriptions must have Azure Backup configured automatically.
4. Administrative overhead must be minimized, and permissions must adhere to the principle of least privilege.

Which design strategy should you recommend?

  1. A
    Assign the Reader role directly to each auditor's individual Microsoft Entra user account at the Production-MG scope. Configure an eligible assignment for a Microsoft Entra security group containing the SREs for the Virtual Machine Contributor role at the Production-MG scope using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect to configure backup for virtual machines.
  2. Assign the Reader role to a Microsoft Entra security group containing the security auditors at the Production-MG scope. Configure an eligible assignment for a Microsoft Entra security group containing the SREs for the Virtual Machine Contributor role at the Production-MG scope using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect to configure backup for virtual machines.Answer
  3. C
    Assign the Reader role to a Microsoft Entra security group containing the security auditors at the Production-MG scope. Configure an active assignment for a Microsoft Entra security group containing the SREs for the Virtual Machine Contributor role at the Production-MG scope using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect to configure backup for virtual machines.
  4. D
    Assign the Reader role to a Microsoft Entra security group containing the security auditors at the Production-MG scope. Configure an eligible assignment for a Microsoft Entra security group containing the SREs for the Virtual Machine Contributor role at the Production-MG scope using Privileged Identity Management (PIM). Deploy an Azure Policy with the Deny effect to prevent virtual machines from being deployed without Azure Backup configured.

Answer

Assign the Reader role to a Microsoft Entra security group containing the security auditors at the Production-MG scope. Configure an eligible assignment for a Microsoft Entra security group containing the SREs for the Virtual Machine Contributor role at the Production-MG scope using Privileged Identity Management (PIM). Deploy an Azure Policy with the DeployIfNotExists effect to configure backup for virtual machines.
The correct strategy uses group-based role assignments to minimize overhead, configures eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time access for SREs, and uses an Azure Policy with the DeployIfNotExists effect to automatically configure backups for new virtual machines.

Step-by-Step Solution

1
Address the security auditor requirement using group-based RBAC
Create a Microsoft Entra security group for auditors and assign the Reader role to that group at the Production-MG scope.
Assigning roles to groups instead of individual users reduces administrative overhead and aligns with Azure identity governance best practices.
2
Configure temporary admin access for the SRE team using PIM
Create a Microsoft Entra security group for SREs and configure an eligible assignment for the Virtual Machine Contributor role at the Production-MG scope using Privileged Identity Management (PIM).
An eligible assignment allows SREs to request just-in-time (JIT) access when responding to incidents, adhering to the principle of least privilege.
3
Automate VM backup configurations with Azure Policy
Deploy an Azure Policy at the Production-MG scope with the DeployIfNotExists effect.
The DeployIfNotExists effect evaluates the compliance status and automatically deploys the backup configuration, meeting the automation requirement without blocking the deployment of resources.

Key Concept

Azure RBAC and Subscription Governance utilizing Microsoft Entra groups, Privileged Identity Management (PIM) eligible assignments, and Azure Policy remediation effects.
Rate this question

Topics

Azure RBAC and Subscription Governance