Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance and identity delegation strategy for a hybrid environment organized under a single management group hierarchy. The design must accommodate two distinct administrative requirements:

- A third-party audit team requires read-only access to view all resources and security configurations across all subscriptions under the Root Management Group, but only during scheduled quarterly audit windows.
- The cloud operations team must be able to deploy, start, stop, and delete virtual machines within the Prod-Compute-RG resource group under the Production subscription, without being able to modify access control settings or delegate roles.

The design must minimize administrative overhead and enforce the principle of least privilege.

Which two actions should you include in the identity and governance design?

  1. Configure an eligible role assignment in Microsoft Entra Privileged Identity Management (PIM) at the Root Management Group scope for a security group containing the audit team members.Cevap
  2. Assign the Virtual Machine Contributor role to a security group containing the operations team members at the Prod-Compute-RG resource group scope.Cevap
  3. C
    Configure a permanently active role assignment in Microsoft Entra Privileged Identity Management (PIM) at the Root Management Group scope for a security group containing the audit team members.
  4. D
    Assign the Virtual Machine Contributor role directly to the individual Entra ID user accounts of each operations team member at the Prod-Compute-RG resource group scope.

Cevap

Configure an eligible role assignment in Microsoft Entra Privileged Identity Management (PIM) at the Root Management Group scope for a security group containing the audit team members, and assign the Virtual Machine Contributor role to a security group containing the operations team members at the resource group scope.
The correct solution involves configuring an eligible role assignment in Microsoft Entra PIM at the Root Management Group level for the security auditors, and assigning the Virtual Machine Contributor role to a security group at the resource group scope for the operations team. Using PIM eligible assignments ensures that auditors only have access when they activate their role during scheduled audits. Using the Virtual Machine Contributor role at the resource group scope allows the operations team to manage virtual machines without having permission to manage access control. Group-based assignments ensure scalable governance.

Adım Adım Çözüm

1
Analyze the audit team's access requirements.
The audit team requires periodic, temporary access across all subscriptions. Permission inheritance from the Root Management Group is required, and access must be restricted to scheduled windows.
This determines that Microsoft Entra Privileged Identity Management (PIM) should be used at the Root Management Group scope with eligible (just-in-time) assignments rather than permanent active assignments.
2
Analyze the operations team's permissions and scope requirements.
The operations team needs to manage virtual machines within a single resource group, without modifying access control (RBAC).
This maps to the Virtual Machine Contributor built-in role scoped to the specific resource group (Prod-Compute-RG), which excludes User Access Administrator privileges.
3
Apply scale and administrative overhead design constraints.
Assign permissions to Entra ID security groups rather than individual user accounts.
Group-based assignment aligns with Microsoft identity governance best practices to reduce administrative overhead and scale access management.

Anahtar Kavram

Azure RBAC and subscription governance require using group-based assignments for scale, built-in roles like Virtual Machine Contributor for least-privilege resource management, and Microsoft Entra PIM with eligible assignments to govern temporary or periodic privileged scopes.
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance