Examkin

Soru

Zorluk: ZorEntra ID Governance and Privileged Access

A multinational media production company is restructuring its delegation of administrative privileges in Azure for temporary regional media production teams. The design must satisfy the following security and compliance requirements:
- External production managers must only be granted administrative access to their respective regional subscription resources for the duration of a project, not exceeding 90 days.
- Activation of administrative access must require multi-factor authentication (MFA) and approval from the internal IT Security Lead.
- All administrative roles must be assigned using groups rather than individual user assignments to facilitate scalable auditing.
- External managers must not possess permanent active standing privileges.

Which two actions should you include in the design to meet the requirements? (Select two.)

  1. Assign the required Azure RBAC roles to a role-assignable Microsoft Entra group, and configure the external managers as eligible members of this group in Privileged Identity Management (PIM) for Groups.Cevap
  2. Configure a PIM for Groups activation policy for the group that requires multi-factor authentication (MFA) and approval from the IT Security Lead.Cevap
  3. C
    Assign the required Azure RBAC roles directly to each external manager's user account as eligible in PIM for Azure Resources, configuring activation rules on each resource.
  4. D
    Assign the external managers as permanently active members of a Microsoft Entra security group that has the required Azure RBAC roles, and rely on Conditional Access to block access outside project hours.

Cevap

Assign the required Azure RBAC roles to a role-assignable group, configure the users as eligible in PIM for Groups, and define a PIM activation policy that enforces MFA and approval from the IT Security Lead.
To meet all constraints, you must design a solution using Privileged Identity Management (PIM) for Groups. By creating a role-assignable group and assigning the Azure RBAC roles to the group itself, you meet the group-based assignment requirement. By designating the external managers as eligible members, they do not have permanent standing access. To enforce the approval and MFA requirements, you must define an activation policy within PIM for Groups that triggers these checks upon membership activation.

Adım Adım Çözüm

1
Evaluate role assignment constraints.
Identified that roles must be assigned using groups rather than individual assignments to facilitate auditing.
This rules out direct assignment to user accounts in PIM for Azure Resources.
2
Address the requirement for no permanent active standing privileges.
Determine that external managers should be configured as eligible members rather than active members of the group.
Eligible membership ensures they only have access when they explicitly activate it, preventing permanent standing access.
3
Enforce JIT activation controls.
Configure a PIM for Groups activation policy to require MFA, justification, and IT Security Lead approval.
This satisfies the requirement that activation of administrative access must require MFA and approval before access is granted.

Anahtar Kavram

Privileged Identity Management (PIM) for Groups allows governance of role-assignable groups, enabling just-in-time elevation of group memberships that carry Azure RBAC roles without granting permanent standing access or violating group-based assignment best practices.
Bu soruyu puanla

Konular

Entra ID Governance and Privileged Access