Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance and access control model for its Azure environment. The environment consists of three business units: Finance, Retail, and Logistics. Each business unit has separate development and production subscriptions.

The design must meet the following requirements:
- Enable central IT to enforce compliance policies across all subscriptions.
- Allow the security audit team to view resource configurations in all subscriptions without viewing data plane payloads.
- Allow business unit administrators to manage resources only within their respective subscriptions.
- Follow the principle of least privilege and minimize administrative overhead.

Which two actions should you include in the governance design? (Select TWO.)

  1. Create a management group hierarchy under the Tenant Root Group with child management groups for each business unit, and assign the compliance policies at the parent management group level.Answer
  2. Create a Microsoft Entra ID group for the security audit team, and assign the Reader role to this group at the root management group level.Answer
  3. C
    Assign the Contributor role directly to each business unit administrator's individual Microsoft Entra ID user account at the subscription level.
  4. D
    Create a custom policy definition with a Deny effect and assign it at the subscription level to automatically deploy diagnostic settings to all resources.

Answer

Create a management group hierarchy under the Tenant Root Group with child management groups for each business unit and assign policies at the parent management group level; also, create a Microsoft Entra ID group for the security audit team and assign the Reader role to this group at the root management group level.
The correct architecture uses a management group hierarchy to organize subscriptions by business unit and apply compliance policies centrally, ensuring inheritance and consistency. Access for the security audit team is granted by assigning the Reader role to a Microsoft Entra ID group at the management group level, which aligns with security group best practices and the principle of least privilege.

Step-by-Step Solution

1
Analyze the requirement for enforcing compliance policies across multiple subscriptions under different business units.
Determine that a management group hierarchy is the most efficient way to organize subscriptions and apply policy definitions, since policies assigned at a management group are inherited by all child subscriptions.
This reduces administrative overhead compared to assigning policies individually per subscription or resource group.
2
Analyze the access requirements for the security audit team.
Assign the Reader role, which permits viewing resource configurations but does not grant access to data plane contents, satisfying the least privilege principle.
Assigning this role to a Microsoft Entra ID group rather than individual users at the management group scope ensures scalability and adheres to identity best practices.
3
Evaluate the incorrect options to identify why they fail to meet best practices.
Identify that direct user assignments violate group-based RBAC principles, and using a Deny policy effect fails to satisfy automatic deployment requirements.
This confirms the selection of the two correct governance and identity configuration actions.

Key Concept

Azure Management Groups, subscription inheritance, and group-based RBAC assignment using the principle of least privilege.
Estimated Time:1m 30s
Rate this question

Topics

Azure RBAC and Subscription Governance