Examkin

Soru

Zorluk: Çok zorAzure RBAC and Subscription Governance

An enterprise is designing its Azure subscription governance and access control model. The organization has the following management group and subscription hierarchy:

* Tenant Root Group
* Corporate (Management Group)
* Production (Management Group)
* Subscription A
* Subscription B
* Non-Production (Management Group)
* Subscription C

You need to design a solution that meets the following security and governance requirements:
1. A team of external auditors must be able to view all Azure resources in the Corporate management group and its children, but they must never be allowed to view sensitive data such as Key Vault secrets or VM administrative credentials.
2. The internal DevOps team requires administrative control over Subscription A and Subscription B, but they must be prevented from deleting any resource groups or modifying resource locks.
3. Landing Zone administrators must only use Microsoft Entra ID groups for RBAC assignments and must be prevented from assigning permissions directly to individual user accounts.

Which two configurations should you recommend to meet the governance and security requirements? (Select TWO.)

  1. Implement a custom RBAC role with Actions set to '*' and NotActions containing 'Microsoft.Authorization/locks/*' and 'Microsoft.Resources/subscriptions/resourceGroups/delete', and assign this role to a Microsoft Entra ID group for the DevOps team at the Production management group level.Cevap
  2. Create and assign an Azure Policy definition at the Corporate management group level that uses the Deny effect to block the creation of role assignments where the principalType property of the Microsoft.Authorization/roleAssignments resource is set to 'User'.Cevap
  3. C
    Assign the Reader role directly to the individual Microsoft Entra ID user accounts of the external auditors at the Corporate management group level to verify compliance.
  4. D
    Assign the User Access Administrator role to the Landing Zone administrators group at the Corporate management group level, configuring their role assignments in Microsoft Entra Privileged Identity Management (PIM) as permanently active.

Cevap

Implement a custom RBAC role for the DevOps team with Actions set to '*' and NotActions containing 'Microsoft.Authorization/locks/*' and 'Microsoft.Resources/subscriptions/resourceGroups/delete' assigned at the Production management group level, and deploy an Azure Policy definition at the Corporate management group level that denies role assignments where the principalType is 'User'.
The correct configurations involve creating a custom RBAC role for the DevOps team that explicitly uses NotActions to subtract delete and lock capabilities from the wildcard Actions, and implementing an Azure Policy at the Corporate management group level that blocks the creation of role assignments where the principal type is an individual user. This effectively enforces group-based assignment and least privilege principles.

Adım Adım Çözüm

1
Analyze the auditor requirement
Auditors require read-only access to all resources under the Corporate management group without viewing secrets. Since the built-in Reader role allows viewing resources but does not grant data-plane access to Key Vault secrets or VM administrative commands, assigning the Reader role at the Corporate management group level satisfies this requirement.
Ensures audit visibility across the entire hierarchy while preserving data confidentiality.
2
Analyze the DevOps delegation and restriction requirement
The DevOps team needs full control over Subscription A and Subscription B (which are children of the Production management group) but cannot delete resource groups or modify locks. A custom RBAC role with Actions set to '*' and NotActions containing 'Microsoft.Authorization/locks/*' and 'Microsoft.Resources/subscriptions/resourceGroups/delete' is created and assigned at the Production management group level.
Applies the custom role at the parent management group level of the target subscriptions, leveraging inheritance while restricting deletions and locks via NotActions.
3
Analyze the Landing Zone administrator constraint
Landing Zone administrators must be forced to use group-based assignments. An Azure Policy definition targeting the 'Microsoft.Authorization/roleAssignments' resource type with a rule that denies creation when 'principalType' equals 'User' is assigned at the Corporate management group level.
Enforces compliance at scale by preventing administrators from bypassing group-based access control.

Anahtar Kavram

Azure RBAC inheritance, custom roles, and Azure Policy integration for subscription governance.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance