Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

An enterprise is designing a governance and identity strategy for its multi-subscription Azure environment. The environment is organized under a single management group hierarchy with separate production and non-production management groups.

The strategy must meet the following requirements:
- A security audit team must be able to view all resource configurations and compliance logs across all subscriptions.
- The database administration team requires permissions to manage Azure SQL databases across all subscriptions, but these permissions must only be active during approved maintenance windows.
- All administrative privileges must scale efficiently as employees join or leave the organization.

Which of the following configurations should you include in the design to meet these requirements while following the principle of least privilege? (Select TWO.)

  1. Create a Microsoft Entra ID group for the security audit team, and assign the Reader role to this group at the root management group level.Cevap
  2. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make a database administration group eligible for the SQL Server Contributor role assigned at the root management group level.Cevap
  3. C
    Assign the Reader role directly to the individual user accounts of each security auditor in the production and non-production management groups.
  4. D
    Create a permanently active role assignment for the database administration group, and deploy an Azure Policy with a DeployIfNotExists effect to automatically revoke access when a maintenance window closes.
  5. E
    Assign the SQL Server Contributor role as a permanently active assignment to the database administrator group at the root management group level to avoid login delays during emergency maintenance.

Cevap

Create a Microsoft Entra ID group for the security audit team, and assign the Reader role to this group at the root management group level; and configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make a database administration group eligible for the SQL Server Contributor role assigned at the root management group level.
The correct options implement scalable, group-based, and least-privilege governance. Creating a Microsoft Entra ID group and assigning the Reader role at the root management group level ensures all nested subscriptions inherit the permission, satisfying the auditing requirement with minimal overhead. Making the database administration group eligible for the SQL Server Contributor role via PIM for Groups provides just-in-time (JIT) access, ensuring that administrative privileges are active only during maintenance windows.

Adım Adım Çözüm

1
Analyze the access requirement for the security audit team.
Identify that the team needs read-only access (Reader role) across all subscriptions, which should be assigned to a group at the root management group level to ensure inheritance and reduce administrative overhead.
This satisfies the view-only and scalability requirements efficiently without directly assigning roles to individual users.
2
Analyze the access requirement for the database administration team.
Identify that SQL database management is required, but it must be time-bound (just-in-time access). Configure Privileged Identity Management (PIM) for Groups to make the group eligible for the SQL Server Contributor role at the root management group level.
This ensures access is not permanently active, satisfying the principle of least privilege and approved maintenance window constraint.
3
Evaluate the distractors against Azure governance best practices.
Discard direct user assignments, permanent active role configurations for JIT requirements, and inappropriate Azure Policy effects for identity lifecycle management.
Direct assignments violate scalability, permanent assignments violate least privilege, and Azure Policy is not an identity lifecycle management tool.

Anahtar Kavram

Azure RBAC inheritance and Privileged Identity Management (PIM) for group-based governance.
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance