Examkin

Soru

Zorluk: KolayAzure RBAC and Subscription Governance

Your organization has a new Azure subscription. You need to grant administrative access to five new cloud engineers. The solution must minimize administrative overhead and align with Azure governance best practices. How should you assign the required access?

  1. A
    Assign the required RBAC role directly to the individual Microsoft Entra ID user accounts of the five cloud engineers at the subscription scope.
  2. B
    Assign the required RBAC role to the individual cloud engineers using Microsoft Entra Privileged Identity Management (PIM) and configure their assignments to be permanently active.
  3. Create a Microsoft Entra ID security group, add the five cloud engineers as members, and assign the required RBAC role to the group at the subscription scope.Cevap
  4. D
    Apply an Azure Policy with the Deny effect to prevent unauthorized resource deployment, and assign individual user access permissions via policy remediation.

Cevap

Create a Microsoft Entra ID security group, add the five cloud engineers as members, and assign the required RBAC role to the group at the subscription scope.
The correct approach is to assign the RBAC role to a Microsoft Entra security group. By grouping users, you simplify access control administration. When team members change, you only need to update the group membership rather than managing individual role assignments at the subscription level.

Adım Adım Çözüm

1
Create a Microsoft Entra ID security group representing the team of cloud engineers.
A security group is created in Microsoft Entra ID.
Security groups serve as a single management point for collection of users with identical permission requirements.
2
Add the five cloud engineers to the newly created security group.
The users become members of the group and will inherit any access assigned to the group.
This isolates group membership changes from Azure RBAC assignments, reducing subsequent modifications at the scope level.
3
Assign the required RBAC role to the security group at the subscription scope.
All members of the group receive administrative access to the subscription.
This grants permissions efficiently while ensuring scalable access management.

Anahtar Kavram

Group-based access control in Azure RBAC
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance