Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

An enterprise operates a multi-subscription Azure environment managed under a single root management group. You are designing a security and governance solution for a team of database administrators (DBAs) and a compliance auditing team.

The DBAs must be able to create and modify Azure SQL databases, but they must be prevented from deleting databases or altering SQL Server firewall rules. Their access must be limited to their 8-hour shifts, require manager approval, and scale automatically without manual role assignments when new DBAs join the team.

The compliance auditing team requires that all SQL servers automatically configure diagnostic logging to a centralized storage account without blocking database creation operations.

Which governance and access control configuration should you recommend?

  1. Assign a custom Azure RBAC role with `Microsoft.Sql/servers/databases/*` in Actions and `Microsoft.Sql/servers/databases/delete` in NotActions to a Microsoft Entra security group. In Microsoft Entra Privileged Identity Management (PIM), make the group eligible for the role with a maximum activation duration of 8 hours and approval requirements. Assign an Azure Policy with the DeployIfNotExists effect at the root management group scope.Cevap
  2. B
    Assign a custom Azure RBAC role with `Microsoft.Sql/servers/databases/*` in Actions and `Microsoft.Sql/servers/databases/delete` in NotActions directly to each DBA's Microsoft Entra user account. In Microsoft Entra Privileged Identity Management (PIM), make the user accounts permanently active in the role. Assign an Azure Policy with the Deny effect to block any SQL server deployments that lack diagnostic settings.
  3. C
    Assign a custom Azure RBAC role with `Microsoft.Sql/servers/databases/*` in Actions and `Microsoft.Sql/servers/databases/delete` in NotActions to a Microsoft Entra security group. In Microsoft Entra Privileged Identity Management (PIM), make the group eligible for the role with a maximum activation duration of 8 hours and approval requirements. Assign an Azure Policy with the Deny effect at the root management group scope.
  4. D
    Assign the built-in SQL DB Contributor role directly to each DBA's Microsoft Entra user account. In Microsoft Entra Privileged Identity Management (PIM), make the users active in the role with a maximum duration of 8 hours and approval requirements. Assign an Azure Policy with the DeployIfNotExists effect at the root management group scope.

Cevap

Assign a custom Azure RBAC role restricting database deletion to a Microsoft Entra security group, configure that group as eligible in Microsoft Entra Privileged Identity Management (PIM) with approval and an 8-hour duration limit, and deploy an Azure Policy with the DeployIfNotExists effect at the root management group.
The correct solution uses a custom role to prevent database deletion, assigns it to a Microsoft Entra group to allow dynamic scalability as DBAs join, configures PIM eligibility for just-in-time access restricted to 8 hours with approval, and utilizes a DeployIfNotExists policy to automatically deploy diagnostics without interrupting resource provisioning.

Adım Adım Çözüm

1
Define a custom RBAC role.
A custom role is created with Actions permitting database management (e.g., `Microsoft.Sql/servers/databases/*`) and NotActions preventing deletion (e.g., `Microsoft.Sql/servers/databases/delete`). Firewalls cannot be modified as they require server-level permissions.
Built-in roles like SQL DB Contributor allow database deletion, violating the security requirement. A custom role enforces the principle of least privilege.
2
Determine the role assignment target.
The custom role is assigned to a Microsoft Entra security group at the root management group scope rather than to individual user accounts.
Direct user assignment introduces high administrative overhead and violates best practices for group-based access management.
3
Configure JIT access controls using Privileged Identity Management (PIM).
The security group's assignment to the role is defined as eligible, setting a maximum activation duration of 8 hours and requiring manager approval.
This implements shift-based access and satisfies just-in-time requirements, avoiding permanently active privileges.
4
Select the correct Azure Policy effect for diagnostic configurations.
Deploy an Azure Policy using the DeployIfNotExists effect to automatically configure diagnostic logs.
DeployIfNotExists remediates non-compliant resources after deployment without blocking resource creation, whereas a Deny policy would block the creation of the SQL server if the settings are missing in the initial request.

Anahtar Kavram

Azure RBAC, Entra PIM, and Azure Policy integration for subscription governance
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance