Examkin

Soru

Zorluk: ZorEntra ID Governance and Privileged Access

A global retail firm is designing a privileged access and identity governance strategy for their Azure environment. The firm has the following requirements:
- External developers must be granted temporary, just-in-time (JIT) Contributor access to specific resource groups. This access must be assigned and managed collectively to simplify auditing and onboarding/offboarding.
- The IT department must enforce a tenant-wide Conditional Access policy requiring Multi-Factor Authentication (MFA) for all administrative roles, while ensuring that the organization does not get locked out of the tenant in the event of an MFA service outage.

Which of the following designs meets these requirements while adhering to the principle of least privilege?

  1. A
    Assign the Contributor role directly to each external developer's user account as active in Microsoft Entra Privileged Identity Management (PIM) for Azure resources. Create a Conditional Access policy requiring MFA for administrative roles, and exclude emergency access accounts from this policy.
  2. B
    Create a Microsoft Entra security group for the external developers. Assign the group the Contributor role on the target resource groups as a permanent active assignment. Create a Conditional Access policy requiring MFA for administrative roles, applying it to all accounts including emergency access accounts.
  3. Create a Microsoft Entra security group for the external developers. Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to assign the group as eligible for the Contributor role on the target resource groups. Create a Conditional Access policy requiring MFA for administrative roles, and exclude emergency access accounts from this policy.Cevap
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to assign each external developer's user account as eligible for the Contributor role on the target resource groups. Create a Conditional Access policy requiring MFA for administrative roles, applying it to all accounts including emergency access accounts.

Cevap

Create a Microsoft Entra security group for the external developers. Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to assign the group as eligible for the Contributor role on the target resource groups. Create a Conditional Access policy requiring MFA for administrative roles, and exclude emergency access accounts from this policy.
The correct option addresses all compliance requirements. Assigning the Contributor role as eligible to a Microsoft Entra security group ensures just-in-time (JIT) access via PIM, while keeping administration manageable and auditable via group membership. Excluding emergency access (break-glass) accounts from the Conditional Access MFA policy prevents lockout in case of an MFA outage.

Adım Adım Çözüm

1
Analyze the governance requirement for group-based resource access.
Identify that permissions must be assigned to Microsoft Entra security groups rather than directly to individual user accounts to adhere to administrative delegation and audit scalability best practices.
Assigning roles directly to individuals is harder to manage and audit over time.
2
Analyze the just-in-time (JIT) access requirement.
Determine that the Contributor role assignment should be configured as eligible in Privileged Identity Management (PIM) rather than active.
Eligible assignments require users to explicitly activate the role when needed, supporting JIT principles, whereas active assignments grant privileges permanently.
3
Analyze the security and availability requirements for administrative MFA.
Exclude emergency access (break-glass) accounts from the Conditional Access policy requiring MFA.
Ensures the organization can access the tenant if an MFA service outage or identity provider disruption occurs, preventing tenant lockout.

Anahtar Kavram

Group-based role delegation with Privileged Identity Management (PIM) and Conditional Access emergency exclusions.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Entra ID Governance and Privileged Access