Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

A fintech company is designing a privileged access and governance model to secure their Azure subscriptions and comply with regulatory requirements. The model must satisfy the following requirements:
- Developers require temporary, just-in-time (JIT) access to the Contributor role on subscriptions for troubleshooting, with a maximum duration of 4 hours.
- The administrative overhead for managing user-to-role mappings must be minimized.
- Access paths must be fully auditable.

Which of the following actions should you recommend to meet these requirements? (Select TWO.)

  1. Assign the Contributor role to a Microsoft Entra ID security group as an eligible assignment in Privileged Identity Management (PIM) for Azure resources.Answer
  2. B
    Configure the Contributor role assignments for developers as permanently active in Privileged Identity Management (PIM) to avoid role activation delays.
  3. C
    Assign the Contributor role directly to individual developer user accounts in Microsoft Entra ID to trace access audits directly to the user.
  4. Require developers to activate the eligible subscription role by completing a multi-factor authentication (MFA) challenge during the PIM activation process.Answer

Answer

The correct recommendations are to assign the Contributor role to a Microsoft Entra ID security group as an eligible assignment in Privileged Identity Management (PIM) for Azure resources, and to require developers to activate the eligible subscription role by completing a multi-factor authentication challenge during PIM activation.
The correct configuration uses Microsoft Entra security groups mapped to eligible PIM assignments for Azure resources, which allows group-based governance and minimizes administrative overhead. Requiring multi-factor authentication during role activation ensures that the identity is verified prior to granting Contributor access, fulfilling security requirements.

Step-by-Step Solution

1
Analyze the requirement for just-in-time (JIT) administrative access.
PIM eligible assignments are identified as the solution for JIT, whereas permanently active assignments are ruled out.
Permanently active assignments violate the JIT principle of least privilege.
2
Analyze the requirement to minimize administrative overhead.
Group-based role assignment is preferred over direct user assignment.
Direct user role assignments scale poorly and increase administrative overhead compared to managing group memberships.
3
Evaluate the need for secure, auditable privilege escalation.
Requiring MFA upon PIM role activation is selected.
Adding MFA verification during role activation secures the identity at the exact moment privileged access is requested.

Key Concept

Privileged Identity Management (PIM) eligible assignments combined with group-based RBAC roles provide scalable JIT access with strong authentication verification.
Rate this question

Topics

Entra ID Governance and Privileged Access