Examkin

Soru

Zorluk: OrtaEntra ID Governance and Privileged Access

An educational institution is restructuring its Azure administration model. The institution needs to delegate temporary access to a team of eight junior DevOps engineers who require the Subscription Contributor role to perform deployment tasks. The design must satisfy the following security and governance requirements:

- The junior DevOps engineers must only have administrative permissions when actively working on scheduled deployments.
- Administrative access must be managed using a group-based model to minimize administrative overhead.
- Multi-Factor Authentication (MFA) must be enforced for all administrative tasks.
- Two dedicated emergency-access (break-glass) accounts must be exempt from tenant lockout risks and maintain access if MFA services are unavailable.

Which two actions should you include in the identity and governance design? (Select TWO.)

  1. Assign the Subscription Contributor role to a Microsoft Entra ID group containing the DevOps engineers as an eligible assignment in Privileged Identity Management (PIM) for Azure resources.Cevap
  2. B
    Assign the Subscription Contributor role directly to the individual user accounts of each junior DevOps engineer as an eligible assignment in Privileged Identity Management (PIM) for Azure resources.
  3. C
    Configure the Subscription Contributor role assignment for the DevOps team group as a permanently active assignment in Privileged Identity Management (PIM) for Azure resources.
  4. Exclude the two emergency access accounts from the Conditional Access policy that enforces Multi-Factor Authentication (MFA) for administrative roles.Cevap
  5. E
    Apply the MFA Conditional Access policy to all administrative accounts, including the two emergency access accounts, to guarantee that no administrative access is allowed without MFA.

Cevap

Assign the Subscription Contributor role to a Microsoft Entra ID group as eligible in Privileged Identity Management (PIM) and exclude emergency access accounts from the Multi-Factor Authentication (MFA) Conditional Access policy.
The correct design utilizes group-based role assignments in Privileged Identity Management (PIM) to minimize administrative overhead while requiring just-in-time activation to align with the principle of least privilege. Additionally, the emergency access (break-glass) accounts must be excluded from Conditional Access policies enforcing Multi-Factor Authentication (MFA) to prevent tenant lockout during an MFA service outage.

Adım Adım Çözüm

1
Group the junior DevOps engineers into a Microsoft Entra ID security group.
Provides a single administrative boundary for role management, avoiding direct user assignments.
Simplifies management and adheres to administrative scaling best practices.
2
Configure the security group with an eligible role assignment for the Subscription Contributor role in Privileged Identity Management (PIM) for Azure resources.
Enables just-in-time (JIT) role activation, ensuring permissions are only active during scheduled deployments.
Meets the requirement for temporary access and least privilege.
3
Exclude the two dedicated emergency-access accounts from the Conditional Access policy that enforces MFA for administrative access.
Guarantees access to the Azure tenant even if MFA services are completely unavailable.
Protects against tenant lockout, satisfying the break-glass configuration best practices.

Anahtar Kavram

Privileged Identity Management (PIM) and emergency access governance
Bu soruyu puanla

Konular

Entra ID Governance and Privileged Access