Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

A retail company wants to delegate management of Azure SQL databases in a specific resource group named 'SQL-Prod-RG' to a database operations team. The security team has defined the following requirements for this delegation:

- Access must be granted using the principle of least privilege.
- Administrative overhead must be minimized when onboarding or offboarding team members.
- Access must not be persistent; team members must request access on-demand for a limited duration.

Which of the following strategies should you recommend to meet these requirements?

  1. A
    Configure Microsoft Entra Privileged Identity Management (PIM) to make the individual user accounts of the database operations team eligible for the SQL Server Contributor role at the SQL-Prod-RG resource group scope.
  2. B
    Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group containing the database operations team permanently active in the SQL Server Contributor role at the SQL-Prod-RG resource group scope.
  3. Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group containing the database operations team eligible for the SQL Server Contributor role at the SQL-Prod-RG resource group scope.Cevap
  4. D
    Assign the Owner role to a Microsoft Entra ID security group containing the database operations team at the subscription level, and deploy an Azure Policy with a Deny effect to block modifications outside the SQL-Prod-RG resource group.

Cevap

Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group containing the database operations team eligible for the SQL Server Contributor role at the SQL-Prod-RG resource group scope.
The correct strategy combines a Microsoft Entra ID security group to minimize operational overhead, the SQL Server Contributor role scoped to the SQL-Prod-RG resource group to follow the principle of least privilege, and Microsoft Entra Privileged Identity Management (PIM) eligibility to ensure access is only active on-demand for a limited duration.

Adım Adım Çözüm

1
Select the correct identity principal to minimize administrative overhead.
A Microsoft Entra ID security group is used to manage the members of the database operations team.
Directly assigning roles to user accounts creates administrative overhead as team members join or leave.
2
Select the appropriate role and scope to follow the principle of least privilege.
The SQL Server Contributor role is scoped to the SQL-Prod-RG resource group.
Subscription-level assignments or high-privilege roles like Owner violate the least privilege principle when only SQL database management in a specific resource group is needed.
3
Select the appropriate access activation mechanism to meet the non-persistence requirement.
Configure the security group's PIM assignment as eligible.
Eligible assignments require users to request activation on-demand, whereas active assignments grant persistent access, violating the security requirement.

Anahtar Kavram

Azure RBAC delegation combined with Microsoft Entra Privileged Identity Management (PIM) group eligibility and resource group scoping to achieve scalable, least-privilege, and time-bound access control.
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance