Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

A digital media company is designing a subscription governance strategy for a dedicated rendering subscription in Azure. The strategy must satisfy the following requirements:
* A team of external editors must be able to manage virtual machines and storage accounts within the subscription.
* The editors' access must be restricted to scheduled editing windows and must not be permanently active.
* Administrative overhead must be minimized by avoiding permissions assigned directly to individual user accounts.
* Any new storage account deployed in the subscription must be automatically configured to use customer-managed keys (CMKs) to satisfy compliance audits.

Which governance configuration should you recommend to meet these requirements?

  1. A
    Assign the Virtual Machine Contributor and Storage Account Contributor roles directly to each editor's individual user account at the subscription scope, configure their access as eligible using Privileged Identity Management (PIM) for Azure resources, and deploy an Azure Policy with a DeployIfNotExists effect to automatically configure customer-managed keys for new storage accounts.
  2. B
    Assign the Virtual Machine Contributor and Storage Account Contributor roles to a Microsoft Entra security group at the subscription scope, configure the editors as permanent members of the security group, and deploy an Azure Policy with a DeployIfNotExists effect to automatically configure customer-managed keys for new storage accounts.
  3. Assign the Virtual Machine Contributor and Storage Account Contributor roles to a Microsoft Entra security group at the subscription scope, manage the editors' access as eligible group members using Privileged Identity Management (PIM) for Groups, and deploy an Azure Policy with a DeployIfNotExists effect to automatically configure customer-managed keys for new storage accounts.Cevap
  4. D
    Assign the Virtual Machine Contributor and Storage Account Contributor roles to a Microsoft Entra security group at the subscription scope, manage the editors' access as eligible group members using Privileged Identity Management (PIM) for Groups, and deploy an Azure Policy with a Deny effect to block the creation of any storage account that does not have customer-managed keys configured.

Cevap

Assign the roles to a security group, configure eligible membership via Privileged Identity Management (PIM) for Groups, and implement an Azure Policy with a DeployIfNotExists effect.
To minimize administrative overhead and ensure scalability, permissions should be assigned to a group rather than individual users. Utilizing Privileged Identity Management (PIM) for Groups with eligible membership allows for just-in-time access control, ensuring editors only have access during their scheduled windows. To enforce automatic configuration of customer-managed keys for compliance without blocking deployments, an Azure Policy with a DeployIfNotExists effect is the correct choice as it can remediate non-compliant resources upon creation.

Adım Adım Çözüm

1
Identify the administrative requirement for managing group memberships rather than individual accounts.
Security group-based delegation is selected.
Group-based assignments reduce administrative overhead and follow identity governance best practices.
2
Analyze the requirement for restricting access to scheduled editing windows.
Privileged Identity Management (PIM) for Groups with eligible assignments is selected.
This prevents permanent privilege accumulation and enforces just-in-time access control.
3
Evaluate the compliance requirement to automatically configure customer-managed keys for new storage accounts.
Azure Policy with the DeployIfNotExists effect is selected.
DeployIfNotExists automatically remediates non-compliant resources at deployment, whereas a Deny policy would block the deployment entirely.

Anahtar Kavram

Subscription Governance and Least Privilege Access Control
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance