Examkin

Soru

Zorluk: Çok zorAzure RBAC and Subscription Governance

A multinational enterprise operates a hybrid Azure environment under a single Microsoft Entra tenant. The environment is organized under the following management group hierarchy to ensure regulatory compliance and operational isolation:

* Tenant Root Group
* Global-Ops-MG
* Regional-Lz-MG
* EU-Lz-MG
* EU-Prod-Sub (Subscription)
* EU-Dev-Sub (Subscription)
* US-Lz-MG
* US-Prod-Sub (Subscription)
* US-Dev-Sub (Subscription)

A group of regional site reliability engineers (SREs) based in the European Union (EU) needs permissions to manage virtual machine workloads. You must design an identity and governance solution that meets the following requirements:
1. The SREs must be able to start, stop, and resize virtual machines across all subscriptions under the `EU-Lz-MG` management group.
2. The SREs must be prevented from deleting virtual machines in any subscription under `EU-Lz-MG`.
3. The SREs must have no write or delete permissions on resources under the `US-Lz-MG` management group.
4. Access must be granted on-demand and require approval, with all actions audited, to comply with regional financial regulations.
5. The design must minimize administrative overhead and follow the principle of least privilege.

Which design strategy should you implement?

  1. Define a custom Azure RBAC role with AssignableScopes set to the EU-Lz-MG management group scope. Configure Actions as ["Microsoft.Compute/virtualMachines/*", "Microsoft.Resources/subscriptions/resourceGroups/read"] and NotActions as ["Microsoft.Compute/virtualMachines/delete"]. In Microsoft Entra Privileged Identity Management (PIM) for Azure resources, configure an eligible role assignment for a Microsoft Entra security group containing the SREs at the EU-Lz-MG scope.Cevap
  2. B
    Define a custom Azure RBAC role with AssignableScopes set to the EU-Lz-MG management group scope. Configure Actions as ["Microsoft.Compute/virtualMachines/*", "Microsoft.Resources/subscriptions/resourceGroups/read"] and NotActions as ["Microsoft.Compute/virtualMachines/delete"]. In Microsoft Entra Privileged Identity Management (PIM) for Azure resources, configure an active role assignment for a Microsoft Entra security group containing the SREs at the EU-Lz-MG scope with a permanent duration.
  3. C
    Define a custom Azure RBAC role with AssignableScopes set to the EU-Lz-MG management group scope. Configure Actions as ["Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/powerOff/action"]. Assign the custom role directly to individual regional SRE user accounts at the EU-Lz-MG scope using standard Azure RBAC role assignments.
  4. D
    Assign the built-in Virtual Machine Contributor role to a Microsoft Entra security group containing the SREs at the EU-Lz-MG scope. To prevent VM deletions, assign an Azure Policy with a Deny effect at the EU-Lz-MG scope targeting the Microsoft.Compute/virtualMachines delete action, and configure the policy assignment as eligible using PIM.

Cevap

The correct strategy is to define a custom Azure RBAC role at the management group scope that allows all virtual machine actions except deletion, and then configure this role as an eligible assignment to a Microsoft Entra security group using Privileged Identity Management (PIM).
Defining a custom role with Actions set to 'Microsoft.Compute/virtualMachines/*' and NotActions set to 'Microsoft.Compute/virtualMachines/delete' allows SREs to perform start, stop, and resize (which is a write operation) actions while blocking deletion. Setting the AssignableScopes and assigning the role at the management group level (EU-Lz-MG) ensures inheritance across all subscriptions within that management group, while preventing any access to US resources. Using Privileged Identity Management (PIM) with an eligible assignment for a Microsoft Entra security group satisfies the on-demand, approval-based compliance requirement while aligning with the best practice of avoiding direct user assignments.

Adım Adım Çözüm

1
Specify Actions as Microsoft.Compute/virtualMachines/* and NotActions as Microsoft.Compute/virtualMachines/delete.
Allows SREs to perform actions like start, stop, and resize (which requires write operations) while subtracting delete permissions.
Ensures the role adheres strictly to the operational capabilities requested while blocking deletion.
2
Set the AssignableScopes property of the custom role to the EU-Lz-MG management group.
Restricts the applicability of this custom role to the EU management group hierarchy.
Adheres to regional isolation requirements by ensuring US resources cannot be modified under this role.
3
Map the custom role assignment to a Microsoft Entra security group rather than individual users.
Maintains scalable governance and prevents permission sprawl.
Direct user assignment violates Azure identity management best practices.
4
Configure the role assignment as eligible in Privileged Identity Management (PIM) for Azure resources at the EU-Lz-MG scope.
Requires SREs to request activation, receive approval, and generate audit logs.
Meets the regulatory requirement for audited, on-demand, and approved access.

Anahtar Kavram

Azure RBAC inheritance, custom role actions/notActions logic, and JIT group governance via Privileged Identity Management (PIM).
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance