Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A logistics company is designing an access and governance strategy for its telemetry processing workloads in Azure. The workloads run within a single subscription across multiple resource groups. You need to design a solution that delegates administrative access to a team of operations engineers to manage Network Security Groups (NSGs) and route tables in a dedicated networking resource group, while also enforcing temporary, audited access for senior administrators who require the Owner role at the subscription level. The solution must adhere to the principle of least privilege.

Which two actions should you include in the design?

  1. Create a Microsoft Entra ID group for the operations engineers and assign the Network Contributor role to the group at the resource group scope.Answer
  2. B
    Assign the Network Contributor role directly to the individual user accounts of each operations engineer.
  3. Configure Microsoft Entra Privileged Identity Management (PIM) to make the subscription Owner assignments eligible rather than active.Answer
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to make the subscription Owner assignments permanently active.

Answer

Create a Microsoft Entra ID group for the operations engineers and assign the Network Contributor role to the group at the resource group scope; and configure Microsoft Entra Privileged Identity Management (PIM) to make the subscription Owner assignments eligible rather than active.
The correct options recommend creating a Microsoft Entra ID group for the operations engineers to assign the Network Contributor role at the resource group scope, and configuring Microsoft Entra Privileged Identity Management (PIM) to make the subscription Owner assignments eligible. Scoping the Network Contributor role to the resource group ensures least privilege, and group-based assignments ensure scalable identity lifecycle management. Making Owner assignments eligible in PIM ensures that senior administrators only hold high-privileged access when actively requested, justified, and audited, providing just-in-time (JIT) security.

Step-by-Step Solution

1
Analyze delegation requirements for network operations.
Identify that operations engineers need to manage NSGs and route tables, which fits the Network Contributor role. Determine that permissions should be delegated at the resource group scope to adhere to least privilege.
Restricting role assignment to the resource group prevents the team from modifying resources in other resource groups.
2
Select the appropriate assignment target for the network role.
Determine that the Network Contributor role should be assigned to a Microsoft Entra ID group containing the operations engineers rather than directly to individuals.
Group-based role assignment aligns with Microsoft governance best practices and simplifies identity lifecycle management.
3
Analyze high-privileged access requirements for senior administrators.
Identify that the subscription Owner role should be assigned via Microsoft Entra Privileged Identity Management (PIM) with eligible assignments.
Using eligible assignments enforces just-in-time access, meaning users must explicitly activate the role for a limited time when needed, satisfying the requirement for temporary, audited access.

Key Concept

Azure RBAC best practices (group-based assignments and scoping) combined with just-in-time access management using Privileged Identity Management.
Rate this question

Topics

Azure RBAC and Subscription Governance