Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

A global aviation logistics company is designing an identity governance and privileged access strategy for its Azure environment. The environment contains several subscriptions hosting flight scheduling applications.

The company has the following security requirements:
- External consultants must be granted the Contributor role on a subscription named Sub1 only when they are actively performing maintenance tasks.
- The access granted to external consultants must be automatically audited every 30 days, and any access not explicitly re-approved must be revoked.
- Emergency break-glass administrator accounts must remain functional even if there is an outage of the company's identity provider or primary multi-factor authentication (MFA) service.
- All administrator access assignments must follow the principle of least privilege and use group-based assignment where possible.

Which two configuration steps should you recommend to meet these requirements? (Select TWO.)

  1. Create a Microsoft Entra ID security group for the external consultants, configure it as eligible for the Contributor role in Sub1 using Privileged Identity Management (PIM) for Azure resources, and set up a monthly recurring access review.Answer
  2. Configure Conditional Access policies to enforce multi-factor authentication (MFA) for administrative access, ensuring that emergency break-glass accounts are excluded from these policies.Answer
  3. C
    Assign the Contributor role directly to each external consultant's user account as a permanently active role assignment in Sub1 to ensure they always have access to maintenance tasks.
  4. D
    Create a Microsoft Entra ID security group for the external consultants, assign the Contributor role directly to the group in Sub1, and configure a tenant-wide Conditional Access policy requiring MFA for all users with no exclusions.

Answer

Create a Microsoft Entra ID security group for the external consultants, configure it as eligible for the Contributor role in Sub1 using PIM for Azure resources with a monthly recurring access review, and configure Conditional Access policies to enforce MFA for administrative access while excluding emergency break-glass accounts.
To support just-in-time access for external consultants, configuring an eligible role assignment via Privileged Identity Management (PIM) for Azure resources is the correct approach. Group-based assignment ensures scalability. A monthly access review automatically audits and revokes inactive access. For emergency break-glass accounts, excluding them from Conditional Access MFA policies ensures they remain accessible even during an outage of the MFA provider.

Step-by-Step Solution

1
Evaluate the external consultant access requirements.
Identified the need for group-based delegation, just-in-time (JIT) activation, and a 30-day automated review process.
Creating a security group and assigning it as eligible for the Contributor role via Privileged Identity Management (PIM) for Azure resources provides JIT capability. Configuring monthly access reviews satisfies the automatic 30-day revocation requirement.
2
Evaluate the emergency access requirements.
Identified the need to prevent tenant lockout during primary identity provider or MFA service outages.
Excluding emergency break-glass accounts from Conditional Access policies that enforce MFA ensures that administrators can access the environment using alternative verification methods if the primary MFA service goes offline.

Key Concept

Designing privileged access management using Microsoft Entra ID PIM and securing emergency accounts against lockout.
Rate this question

Topics

Entra ID Governance and Privileged Access