Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

A financial services company is designing a subscription governance strategy for its transaction auditing platform. The auditing application runs across multiple resource groups within a dedicated Azure subscription. External audit administrators must be allowed to review resource configurations and database settings for a maximum of 8 hours during quarterly audit windows. To satisfy compliance, the solution must adhere to the principle of least privilege, minimize administrative overhead, and prevent permanent permission assignments. Which of the following designs best meets these requirements?

  1. Create a Microsoft Entra security group containing the audit administrators. Assign the Reader role to the group at the subscription scope, and configure Microsoft Entra Privileged Identity Management (PIM) to make the users eligible for membership in this group.Cevap
  2. B
    Configure Microsoft Entra Privileged Identity Management (PIM) to make each of the three auditor user accounts directly eligible for the Reader role at the subscription scope.
  3. C
    Create a Microsoft Entra security group containing the audit administrators. Assign the Reader role to the group at the subscription scope, and configure Microsoft Entra Privileged Identity Management (PIM) to make the users permanently active members of the group.
  4. D
    Create a Microsoft Entra security group containing the audit administrators. Assign the Reader role to the group at the subscription scope, and deploy an Azure Policy with a Deny effect to restrict read operations outside of the audit window.

Cevap

Create a Microsoft Entra security group containing the audit administrators. Assign the Reader role to the group at the subscription scope, and configure Microsoft Entra Privileged Identity Management (PIM) to make the users eligible for membership in this group.
The correct design uses a Microsoft Entra security group to assign the Reader role at the subscription scope, which simplifies administrative overhead and ensures scalability. By configuring Microsoft Entra Privileged Identity Management (PIM) to make users eligible for group membership, the organization enforces just-in-time access, satisfying the requirement to prevent permanent permissions while restricting the access duration.

Adım Adım Çözüm

1
Analyze governance requirements and identify the identity container to use.
Identify that permissions should be assigned to a Microsoft Entra security group rather than individual user accounts to ensure scalable governance and minimal administrative overhead.
Direct user assignments violate Azure RBAC best practices and increase administrative complexity.
2
Determine the correct role and scope to enforce least privilege.
Select the Reader role at the subscription scope to allow viewing resource configurations and database settings without granting write or delete permissions.
The Reader role is the least privileged built-in role that satisfies the read-only requirement at the subscription scope.
3
Evaluate the mechanism for time-limited, non-permanent access control.
Utilize Microsoft Entra Privileged Identity Management (PIM) to make the audit administrators eligible for the group membership during the audit window.
PIM ensures just-in-time activation with a maximum duration constraint, ensuring that the permissions are not permanently active.

Anahtar Kavram

Azure RBAC and Subscription Governance utilizing Microsoft Entra groups and PIM
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance