Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A financial services firm has an Azure subscription containing production database workloads. The firm's compliance team requires that database administrators (DBAs) only be granted database management administrative access temporarily when executing specific maintenance tasks. Under normal operating conditions, these DBAs should have read-only access to verify service health. Additionally, access assignments must scale efficiently as DBAs join or leave the organization. Which of the following access and governance designs meets these requirements while minimizing administrative overhead and adhering to the principle of least privilege?

  1. Create a Microsoft Entra ID security group for the database administrators, assign the group the Reader role at the subscription scope, and configure Microsoft Entra Privileged Identity Management (PIM) to make the group eligible for the SQL Server Contributor role at the resource group scope.Answer
  2. B
    Assign the Reader role to each individual database administrator's user account at the subscription scope, and configure Microsoft Entra Privileged Identity Management (PIM) to make each individual user account eligible for the SQL Server Contributor role at the resource group scope.
  3. C
    Create a Microsoft Entra ID security group for the database administrators, assign the group the Reader role at the subscription scope, and configure Microsoft Entra Privileged Identity Management (PIM) with a permanently active assignment for the group to the SQL Server Contributor role at the resource group scope.
  4. D
    Create a Microsoft Entra ID security group for the database administrators, assign the group the SQL Server Contributor role at the subscription scope, and implement an Azure Policy with a Deny effect to prevent database modifications unless a specific temporary authorization tag is present.

Answer

Create a Microsoft Entra ID security group for the database administrators, assign the group the Reader role at the subscription scope, and configure Microsoft Entra Privileged Identity Management (PIM) to make the group eligible for the SQL Server Contributor role at the resource group scope.
The correct design utilizes a Microsoft Entra ID security group to simplify user management and assigns the Reader role at the subscription scope to provide steady-state monitoring access. Just-in-time administrative access is granted at the narrower resource group scope by configuring Microsoft Entra Privileged Identity Management (PIM) with an eligible assignment, adhering to the principle of least privilege.

Step-by-Step Solution

1
Create a Microsoft Entra ID security group containing all database administrators.
A single management boundary for identity-based access configuration is established.
Using groups simplifies identity management and ensures access controls scale as administrators join or leave the organization.
2
Assign the Reader role to the security group at the subscription scope.
All group members obtain read-only access across the entire subscription for daily monitoring.
This meets the requirement for normal operations monitoring while avoiding over-provisioning permissions.
3
Configure Microsoft Entra Privileged Identity Management (PIM) to make the security group eligible for the SQL Server Contributor role at the resource group scope.
Group members can request temporary, time-bound administrative access to database resources when needed.
This enforces just-in-time access and applies permissions to a narrow resource scope, satisfying the principle of least privilege.

Key Concept

Designing scalable subscription governance and access control using Azure RBAC groups, least privilege, and Privileged Identity Management (PIM).
Estimated Time:2m 0s
Rate this question

Topics

Azure RBAC and Subscription Governance