Examkin

Question

Difficulty: HardAzure RBAC and Subscription Governance

A healthcare provider operates a single-tenant Azure environment with a management group hierarchy. The internal IT support department has 15 engineers who need the Virtual Machine Contributor role at the subscription scope to resolve high-priority incidents. You must design an administrative access solution that satisfies the following conditions:
1. Operations must scale efficiently when engineers join or leave the department without manually editing role assignments.
2. The principle of least privilege must be enforced by granting administrative permissions only during active incident response windows and automatically removing them afterward.
3. Every elevation of privilege must be recorded for compliance auditing.

Which configuration should you recommend?

  1. A
    Grant the Virtual Machine Contributor role to each engineer's user account using Microsoft Entra Privileged Identity Management (PIM) with an eligible status that mandates approval and a time limit.
  2. B
    Associate a Microsoft Entra security group representing the support team with a persistent active assignment of the Virtual Machine Contributor role at the subscription scope.
  3. Configure a Microsoft Entra security group representing the support team with eligible status for the Virtual Machine Contributor role in Privileged Identity Management (PIM), requiring justification and approval upon activation.Answer
  4. D
    Associate a Microsoft Entra security group representing the support team with a direct assignment of the Virtual Machine Contributor role, and deploy an Azure Policy with a Deny effect to block write actions outside of support incident windows.

Answer

Configure a Microsoft Entra security group representing the support team with eligible status for the Virtual Machine Contributor role in Privileged Identity Management (PIM), requiring justification and approval upon activation.
The correct strategy combines group-based role assignment with Privileged Identity Management (PIM) eligible status. Assigning the role to a Microsoft Entra security group minimizes management overhead as membership changes automatically inherit or lose permissions. Configuring the group with eligible status in PIM ensures just-in-time access, which enforces least privilege and generates audit logs for compliance.

Step-by-Step Solution

1
Analyze the operational efficiency requirement to minimize management overhead.
Identify that role assignments must be managed via a Microsoft Entra security group rather than direct user assignments.
Direct user assignments require manual updates for every team member change, whereas group-based assignments automatically apply to any user added to the group.
2
Evaluate the requirement for temporary, time-bound, and audited access.
Determine that Microsoft Entra Privileged Identity Management (PIM) is required to configure eligible (just-in-time) assignments rather than permanent ones.
PIM provides time-bound activations with mandatory justification, approval workflows, and audit logs, enforcing the principle of least privilege.
3
Assess the option of using Azure Policy to restrict access dynamically.
Reject the Azure Policy Deny effect option as a governance mechanism mismatch.
Azure Policy is designed for resource compliance and configuration enforcement, not for orchestrating temporary identity access or role elevations.

Key Concept

Azure RBAC and Subscription Governance utilizing Microsoft Entra groups and Privileged Identity Management (PIM) to enforce least privilege and minimize administrative overhead.
Rate this question

Topics

Azure RBAC and Subscription Governance