Examkin

Question

Difficulty: EasyAzure RBAC and Subscription Governance

Your company has an Azure subscription containing multiple resource groups. You need to grant administrative permissions to three new IT support engineers to manage virtual machines within a specific resource group. The solution must minimize administrative overhead and follow Azure governance best practices.

Which of the following approaches should you implement?

  1. A
    Assign the Virtual Machine Contributor role directly to each of the three user accounts at the resource group scope.
  2. Create a Microsoft Entra ID group containing the three engineers, and assign the Virtual Machine Contributor role to the group at the resource group scope.Answer
  3. C
    Create a Microsoft Entra ID group containing the three engineers, and configure a Microsoft Entra Privileged Identity Management (PIM) active assignment that permanently assigns the Virtual Machine Contributor role to the group.
  4. D
    Create an Azure Policy definition with a Deny effect to automatically deploy the Virtual Machine Contributor role assignment for the three engineers when the resource group is created.

Answer

Create a Microsoft Entra ID group containing the three engineers, and assign the Virtual Machine Contributor role to the group at the resource group scope.
The correct answer is to create a Microsoft Entra ID security group, add the three engineers to the group, and assign the Virtual Machine Contributor role to the group at the resource group scope. This adheres to the Azure governance best practices of group-based access control and the principle of least privilege, while reducing the administrative effort needed to manage access rights.

Step-by-Step Solution

1
Identify the administrative unit to group the users.
Create a Microsoft Entra ID security group and add the three engineers as members.
Grouping users minimizes administrative overhead and enables scalable access management.
2
Determine the appropriate scope for the role assignment.
Assign permissions at the specific resource group scope rather than the subscription scope.
This enforces the principle of least privilege by ensuring access is limited to only the required resources.
3
Apply the appropriate Azure role to the security group.
Assign the Virtual Machine Contributor role to the created Microsoft Entra ID security group at the resource group scope.
This provides the required administrative permissions to manage virtual machines without using custom roles or individual assignments.

Key Concept

Group-based role assignments and least privilege scopes are fundamental to Azure RBAC and subscription governance.
Estimated Time:45s
Rate this question

Topics

Azure RBAC and Subscription Governance