Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A pharmaceutical research firm is deploying a multi-region clinical data analysis platform inside a single Microsoft Entra tenant. The platform utilizes multiple Azure subscriptions. You must design an administrative access and resource compliance framework to meet the following requirements:
- A group of external audit partners needs read-only access to a specific resource group containing data processing logs.
- Internal platform engineers need the ability to perform high-privilege operations at the subscription root for ad-hoc emergency troubleshooting, but this access must not be permanently active.
- To maintain security standards, all newly provisioned virtual machines must automatically have the dependency agent installed without blocking deployment or requiring engineer intervention.

Which of the following configurations represents the most appropriate strategy to implement these requirements?

  1. A
    Grant Reader permissions directly to each individual auditor's user account at the resource group level. Set up the troubleshooting permissions in Privileged Identity Management (PIM) so the platform engineers are eligible for just-in-time activation. Configure an Azure Policy with the DeployIfNotExists effect to automatically install the dependency agent on new virtual machines.
  2. Establish a Microsoft Entra ID security group for the audit partners and grant this group Reader permissions at the resource group level. Set up the troubleshooting permissions in Privileged Identity Management (PIM) so the platform engineers are eligible for just-in-time activation. Configure an Azure Policy with the DeployIfNotExists effect to automatically install the dependency agent on new virtual machines.Answer
  3. C
    Establish a Microsoft Entra ID security group for the audit partners and grant this group Reader permissions at the resource group level. Set up the troubleshooting permissions in Privileged Identity Management (PIM) as permanently assigned to the platform engineers without requiring activation. Configure an Azure Policy with the DeployIfNotExists effect to automatically install the dependency agent on new virtual machines.
  4. D
    Establish a Microsoft Entra ID security group for the audit partners and grant this group Reader permissions at the resource group level. Set up the troubleshooting permissions in Privileged Identity Management (PIM) so the platform engineers are eligible for just-in-time activation. Configure an Azure Policy with a Deny effect to prevent the creation of virtual machines that do not have the dependency agent pre-installed.

Answer

Establish a Microsoft Entra ID security group for the audit partners and grant this group Reader permissions at the resource group level. Set up the troubleshooting permissions in Privileged Identity Management (PIM) so the platform engineers are eligible for just-in-time activation. Configure an Azure Policy with the DeployIfNotExists effect to automatically install the dependency agent on new virtual machines.
Assigning access to a security group rather than individuals simplifies administration and aligns with standard identity best practices. Using eligible PIM assignments ensures high-privilege access is restricted to on-demand, just-in-time activation, preventing persistent access vulnerabilities. The DeployIfNotExists policy effect automates the deployment of the dependency agent on new virtual machines without blocking user operations, which satisfies the continuous compliance requirement.

Step-by-Step Solution

1
Identify the governance requirements for access delegation, privilege level, and resource compliance.
The audit partners need read access to a specific scope, the engineers need temporary root-level privileges, and new virtual machines require automatic agent installation.
Establishes a baseline for mapping requirements to Azure governance tools.
2
Evaluate the delegation method for the external audit partners.
The design must leverage a Microsoft Entra ID group mapped to the Reader role on the target resource group, avoiding direct user assignments.
Ensures compliance with group-based access control guidelines, reducing administrative overhead.
3
Determine the temporary privilege configuration for engineers and the automation method for agent installation.
Engineers must be configured as eligible in Privileged Identity Management (PIM), and the agent must be deployed using an Azure Policy with a DeployIfNotExists effect.
Maintains least privilege using just-in-time access and implements automated remediation rather than blocking deployments.

Key Concept

Azure RBAC, PIM JIT activation, and Azure Policy remediation effects represent key pillars of subscription governance.
Estimated Time:1m 30s
Rate this question

Topics

Azure RBAC and Subscription Governance