Examkin

Question

Difficulty: EasyAzure RBAC and Subscription Governance

An enterprise is scaling its Azure footprint and needs to grant a newly formed team of developers permission to restart virtual machines in a development resource group. To ensure scalable management and adhere to the principle of least privilege, how should you assign the required permissions?

  1. A
    Assign the Virtual Machine Contributor role directly to each developer's user account at the resource group scope.
  2. Create a Microsoft Entra ID security group containing the developers, and assign the Virtual Machine Contributor role to the group at the resource group scope.Answer
  3. C
    Configure a Privileged Identity Management (PIM) role assignment that makes the Virtual Machine Contributor role permanently active for each individual developer.
  4. D
    Assign an Azure Policy with a Deny effect to the resource group to prevent other users from managing the virtual machines, rather than using RBAC roles.

Answer

Create a Microsoft Entra ID security group containing the developers, and assign the Virtual Machine Contributor role to the group at the resource group scope.
The correct option outlines the standard best practice for Azure RBAC governance. Permissions should be granted to a group rather than individuals to ease maintenance. In addition, the assignment is restricted to the specific resource group to enforce the principle of least privilege.

Step-by-Step Solution

1
Identify the target users and scope.
The target users are a team of developers, and the scope is the development resource group.
Permissions should always be scoped to the lowest level required to limit exposure.
2
Create an identity container for group-based administration.
A Microsoft Entra ID security group is created, and the developers are added as members.
Managing permissions at the group level ensures governance scalability.
3
Assign the appropriate built-in role to the security group.
The Virtual Machine Contributor role is assigned to the security group at the resource group scope.
This grants the minimum required access needed to restart virtual machines within that specific resource group without giving broader access.

Key Concept

Azure RBAC Group Assignment and Least Privilege Scope
Estimated Time:45s
Rate this question

Topics

Azure RBAC and Subscription Governance