Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A logistics company is designing an administration model for its Azure landing zones. The environment has a Management Group hierarchy with a root group named "Logistics-Root" and child groups for different business units.

The company has two specific requirements:
1. A compliance team needs to audit and review resource configurations across all subscriptions under the "Logistics-Root" management group.
2. A network operations team needs to troubleshoot and modify route tables and network security groups inside the subscriptions, but only during scheduled maintenance windows, requiring multi-factor authentication (MFA) and administrator approval before access is granted.

To meet these requirements, which two configurations should you include in the administrative design?

  1. Assign the Reader role to a Microsoft Entra security group containing the compliance team members at the Logistics-Root management group level.Answer
  2. Assign the Network Contributor role as an eligible assignment to a Microsoft Entra security group for the network operations team using Privileged Identity Management (PIM).Answer
  3. C
    Assign the Reader role directly to the individual Microsoft Entra ID user accounts of the compliance team members at the Logistics-Root management group level.
  4. D
    Assign the Network Contributor role as a permanently active assignment to the individual user accounts of the network operations team at the subscription scope.

Answer

Assign the Reader role to a Microsoft Entra security group containing the compliance team members at the Logistics-Root management group level, and assign the Network Contributor role as an eligible assignment to a Microsoft Entra security group for the network operations team using Privileged Identity Management (PIM).
Applying the principle of least privilege and scalable governance is achieved by assigning permissions to security groups rather than individual users. To audit configurations across all subscriptions, the compliance group requires the Reader role at the parent management group level. For temporary administrative access, configuring the network operations group as eligible for the Network Contributor role via Privileged Identity Management ensures that permissions are only activated when required, are time-bound, and require the necessary MFA and approval.

Step-by-Step Solution

1
Analyze the compliance team auditing requirements and scope.
Determine that the Reader role must be assigned at the root Management Group level ('Logistics-Root') so that permissions inherit down through all child subscriptions.
Scope inheritance in Azure RBAC ensures that policies and roles assigned at a higher management group level apply automatically to all resource containers below it.
2
Apply group-based governance for the compliance team role assignment.
Assign the Reader role to a Microsoft Entra security group instead of individual accounts.
Direct user assignment is hard to audit, violates least privilege and management practices, and increases administrative overhead.
3
Analyze the temporary administrative requirements for the network operations team.
Identify that the Network Contributor role is required, but access must be JIT, approved, and require MFA.
Privileged Identity Management (PIM) supports role activation based on approval, MFA verification, and time bounds.
4
Configure the network operations assignment as eligible in PIM.
Assign the Network Contributor role as an eligible assignment to the network operations security group rather than a permanently active direct assignment.
Eligible assignments enforce just-in-time authorization and require explicit activation, preserving the least privilege principle.

Key Concept

Azure RBAC, Subscription Governance, Group-Based Assignments, and Privileged Identity Management (PIM)
Rate this question

Topics

Azure RBAC and Subscription Governance