Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A digital health platform hosts its applications across multiple Azure subscriptions organized under a single management group. To maintain compliance with healthcare regulations, you need to design a subscription governance and access control strategy that meets the following requirements:

* A team of external compliance auditors needs to view all resource configurations across all subscriptions. The members of this auditing team change on a monthly basis.
* Any new subscription added to the management group must automatically deploy Azure Monitor diagnostic settings to a central storage account.
* The lead security engineer needs the ability to manage role assignments but should only have this permission when performing scheduled security audits.

Which design strategy should you recommend?

  1. A
    Assign the Reader role to a Microsoft Entra ID security group containing the external auditors at the management group scope. Deploy an Azure Policy with the Deny effect to block the creation of new subscriptions that lack diagnostic settings. Assign the User Access Administrator role as eligible in Privileged Identity Management (PIM) for the lead security engineer.
  2. B
    Assign the Reader role to a Microsoft Entra ID security group containing the external auditors at the management group scope. Deploy an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings on new subscriptions. Assign the User Access Administrator role as permanently active in Privileged Identity Management (PIM) for the lead security engineer.
  3. Assign the Reader role to a Microsoft Entra ID security group containing the external auditors at the management group scope. Deploy an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings on new subscriptions. Assign the User Access Administrator role as eligible in Privileged Identity Management (PIM) for the lead security engineer.Answer
  4. D
    Assign the Reader role directly to each external auditor's individual Microsoft Entra ID user account at the management group scope. Deploy an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings on new subscriptions. Assign the User Access Administrator role as eligible in Privileged Identity Management (PIM) for the lead security engineer.

Answer

Assign the Reader role to a Microsoft Entra ID security group containing the external auditors at the management group scope. Deploy an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings on new subscriptions. Assign the User Access Administrator role as eligible in Privileged Identity Management (PIM) for the lead security engineer.
The correct strategy uses an Entra ID security group at the management group level to simplify auditor access management via inheritance. It uses the DeployIfNotExists policy effect to automatically remediate non-compliant subscriptions by deploying the required diagnostic settings. Finally, it uses eligible PIM assignments to enforce the principle of least privilege for administrative tasks.

Step-by-Step Solution

1
Address the access requirements for the rotating auditing team.
Create a Microsoft Entra ID security group, add the auditors to the group, and assign the Reader role to the group at the management group scope.
This utilizes Azure RBAC group-based inheritance, allowing you to manage membership updates within a single group rather than re-configuring role assignments across individual subscriptions.
2
Ensure compliance settings are automatically deployed to new subscriptions.
Create and assign an Azure Policy with the DeployIfNotExists effect.
A DeployIfNotExists policy automatically deploys the required diagnostic settings configuration if it is missing, satisfying the requirement for automated remediation.
3
Secure administrative capabilities for the lead security engineer.
Configure Privileged Identity Management (PIM) with the User Access Administrator role assigned as eligible.
Making the assignment eligible ensures the engineer can request just-in-time access only when performing audits, preventing persistent administrative privilege.

Key Concept

Azure subscription governance, resource inheritance, policy-driven remediation, and just-in-time administrative access.
Estimated Time:1m 30s
Rate this question

Topics

Azure RBAC and Subscription Governance