Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A financial services company is designing a subscription governance strategy. The security team must delegate permissions to a cloud operations team to manage network security groups (NSGs) and route tables within a production subscription. The operations team members change frequently, and their access must only be active during their scheduled shifts and automatically expire after eight hours. The design must prevent the operations team from modifying virtual networks or assigning permissions to other users. Additionally, any new resource group created within the subscription must automatically have a delete resource lock deployed to prevent accidental deletion. Which design should you recommend to meet these requirements while minimizing administrative overhead?

  1. Create a Microsoft Entra ID security group containing the operations team members. Use Microsoft Entra Privileged Identity Management (PIM) for Azure resources to configure the group with an eligible assignment to a custom Azure RBAC role at the subscription scope. Deploy an Azure Policy with a DeployIfNotExists effect at the subscription scope to apply the delete resource lock.Answer
  2. B
    Assign a custom Azure RBAC role containing the necessary network permissions directly to the individual user accounts of the operations team. In Microsoft Entra PIM for Azure resources, configure these direct assignments as eligible at the subscription scope. Deploy an Azure Policy with a Deny effect at the subscription scope to block resource group creation if the delete resource lock is missing.
  3. C
    Create a Microsoft Entra ID security group containing the operations team members. In Microsoft Entra PIM for Azure resources, configure a permanently active assignment for the group to a custom Azure RBAC role at the subscription scope. Deploy an Azure Policy with a DeployIfNotExists effect at the subscription scope to apply the delete resource lock.
  4. D
    Create a Microsoft Entra ID security group containing the operations team members. Assign a custom Azure RBAC role containing the necessary network permissions directly to the group at the subscription scope. Deploy an Azure Policy with a Deny effect at the subscription scope to automatically deploy the delete resource lock on new resource groups.

Answer

The correct design creates a Microsoft Entra ID security group, configures an eligible role assignment to a custom Azure RBAC role using PIM for Azure resources, and deploys an Azure Policy with a DeployIfNotExists effect at the subscription scope.
The correct answer combines all security and administrative requirements: using a Microsoft Entra ID group to scale identity administration, using PIM eligible assignments to enforce time-bounded shift access, and using an Azure Policy with a DeployIfNotExists effect to automatically deploy the required delete resource locks.

Step-by-Step Solution

1
Address team membership changes and administrative overhead.
Map the operations team to a Microsoft Entra ID security group instead of making individual user assignments.
Group-based assignment ensures that as team members join or leave, their access is managed dynamically by changing group membership without modifying resource assignments.
2
Address the shift-based and automatic expiration access requirement.
Configure an eligible role assignment using Microsoft Entra Privileged Identity Management (PIM) for Azure resources with a maximum activation duration of eight hours.
Eligible assignments require users to explicitly activate their roles, which can be configured to automatically expire after a set time limit.
3
Address the custom permission boundary.
Create a custom Azure RBAC role containing only the actions for Network Security Groups and Route Tables, excluding Virtual Network modifications and Role Assignments.
This adheres to the principle of least privilege, preventing unauthorized control plane modifications.
4
Address the automatic deployment of the delete resource lock on new resource groups.
Deploy an Azure Policy with a DeployIfNotExists effect targeted at the subscription scope.
Only a DeployIfNotExists policy can automatically create and apply dependent resources (such as resource locks) to newly provisioned resources if they do not exist.

Key Concept

Azure Subscription Governance using PIM, Custom RBAC roles, and DeployIfNotExists policies.
Rate this question

Topics

Azure RBAC and Subscription Governance