Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance strategy for a production Azure subscription. The strategy must meet the following requirements:
- A database operations group must be able to manage database resources only during scheduled maintenance windows, with all access requested on-demand.
- All new resource groups deployed to the subscription must be automatically protected with a 'CanNotDelete' resource lock upon creation.
- Administrative overhead for managing team membership changes must be minimized.

Which solution should you recommend?

  1. Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group eligible for the Azure RBAC contributor role at the subscription scope. Assign an Azure Policy definition to the subscription that uses the 'DeployIfNotExists' effect to deploy a resource lock to new resource groups.Cevap
  2. B
    Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group permanently active for the Azure RBAC contributor role at the subscription scope. Assign an Azure Policy definition to the subscription that uses the 'DeployIfNotExists' effect to deploy a resource lock to new resource groups.
  3. C
    Configure Microsoft Entra Privileged Identity Management (PIM) to make each database operations team member's user account individually eligible for the Azure RBAC contributor role at the subscription scope. Assign an Azure Policy definition to the subscription that uses the 'DeployIfNotExists' effect to deploy a resource lock to new resource groups.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group eligible for the Azure RBAC contributor role at the subscription scope. Assign an Azure Policy definition to the subscription that uses the 'Deny' effect to block resource group creation if a resource lock is not specified.

Cevap

The solution that configures Microsoft Entra Privileged Identity Management (PIM) for a security group with eligible assignments and uses Azure Policy with the DeployIfNotExists effect to create the resource locks.
The correct solution leverages Microsoft Entra ID groups for administrative efficiency, uses PIM eligible assignments to ensure just-in-time (JIT) access during maintenance windows, and uses Azure Policy's DeployIfNotExists effect to automatically apply resource locks, ensuring compliance without blocking resource creation.

Adım Adım Çözüm

1
Select group-based assignment over individual assignment.
Administrative overhead is minimized as team membership changes are handled within Microsoft Entra ID groups without requiring RBAC reassignments.
Direct user assignments violate the standard practice of scalable access management.
2
Determine the PIM activation type.
Eligible assignment is selected so that users must request and activate permissions on-demand.
Permanently active assignments leave persistent permissions, violating the requirement for access limited to maintenance windows.
3
Select the correct Azure Policy effect for automatic remediation.
The DeployIfNotExists effect is chosen to automatically deploy the 'CanNotDelete' lock.
A Deny effect would block the deployment instead of automatically applying the lock to protect new resource groups.

Anahtar Kavram

Combining Entra security groups, PIM eligible roles, and Azure Policy DeployIfNotExists for secure and automated subscription governance.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance