Examkin

Soru

Zorluk: ZorEntra ID Governance and Privileged Access

An enterprise is designing a privileged access governance model for its Microsoft Entra ID tenant to align with corporate security guidelines. The design must satisfy the following requirements:
- Administrative privileges must be granted on a temporary, just-in-time (JIT) basis.
- Privileged access management must scale efficiently without causing high administrative overhead as the team grows.
- All administrative access to cloud resources must be protected by Multi-Factor Authentication (MFA).
- The enterprise must ensure that administrators can still access the tenant in the event of a widespread MFA service disruption or identity provider outage.

Which identity and access management design should you recommend?

  1. A
    Create Microsoft Entra security groups for administrative roles, configure these groups as permanently active for the roles, enforce Multi-Factor Authentication (MFA) via Conditional Access, and exclude a designated emergency access account from the MFA policy.
  2. B
    Assign individual user accounts directly as eligible for the administrative roles in Privileged Identity Management (PIM), enforce Multi-Factor Authentication (MFA) via Conditional Access, and exclude a designated emergency access account from the MFA policy.
  3. Create Microsoft Entra security groups for administrative roles, configure these groups as eligible for the roles in Privileged Identity Management (PIM), enforce Multi-Factor Authentication (MFA) for administrative access via Conditional Access, and exclude a designated emergency access account from the MFA policy.Cevap
  4. D
    Create Microsoft Entra security groups for administrative roles, configure these groups as eligible for the roles in Privileged Identity Management (PIM), and enforce Multi-Factor Authentication (MFA) via Conditional Access for all administrative accounts without any exclusions.

Cevap

Create Microsoft Entra security groups for administrative roles, configure these groups as eligible for the roles in Privileged Identity Management (PIM), enforce Multi-Factor Authentication (MFA) for administrative access via Conditional Access, and exclude a designated emergency access account from the MFA policy.
The correct strategy uses group-based access management for scalability, Privileged Identity Management (PIM) eligibility for just-in-time access, Conditional Access policies for MFA security, and excludes a break-glass account to ensure resiliency against service outages.

Adım Adım Çözüm

1
Select a scalable structure for role assignments
Use Microsoft Entra ID security groups (role-assignable groups) instead of assigning permissions to individual users.
Group-based assignment reduces management overhead and makes permissions scaling easier.
2
Configure just-in-time (JIT) administrative access
Use Privileged Identity Management (PIM) to configure role assignments as eligible rather than permanently active.
Eligible assignments ensure users must request access when needed, minimizing standing privileges.
3
Secure administrative sessions with MFA and prevent lockout
Implement a Conditional Access policy enforcing MFA for the administrative groups, and exclude a designated emergency access (break-glass) account.
This guarantees security for daily operational accounts while ensuring access is preserved during an identity provider or MFA service outage.

Anahtar Kavram

Designing secure and resilient privileged access using Microsoft Entra Privileged Identity Management, group-based RBAC, and emergency lockout protection policies.
Bu soruyu puanla

Konular

Entra ID Governance and Privileged Access