Examkin

Soru

Zorluk: Çok zorEntra ID Governance and Privileged Access

An organization is designing an identity governance and privileged access strategy for a new Azure environment. The environment contains 15 subscriptions grouped under a single management group. The security team establishes the following requirements:
- External security auditors must be able to temporarily activate the Reader role at the management group level for up to 8 hours to perform quarterly audits. Activation must require approval from the SecOps manager and multi-factor authentication (MFA).
- The Azure Platform Engineers must have administrative access to the subscriptions, but their daily-use accounts must not have standing owner privileges.
- A break-glass emergency administrator account must be created to ensure access to the Microsoft Entra tenant if a federation outage occurs, and this account must bypass standard MFA blocks to prevent lockout.
- All access assignments must align with Azure security best practices and minimize administrative overhead.

Which design should you recommend to meet the requirements while adhering to Microsoft security best practices?

  1. A
    Assign the individual auditor accounts directly as eligible for the Reader role at the management group level using Privileged Identity Management (PIM) for Azure resources, configuring approval and MFA requirements on activation. Create a security group for the engineers and assign it as eligible for the Owner role. Exclude the emergency administrator account from the Conditional Access policy that enforces MFA for administrative portals.
  2. Create a Microsoft Entra ID security group for the auditors and assign it as eligible for the Reader role at the management group level using Privileged Identity Management (PIM) for Azure resources, configuring approval and MFA requirements on activation. Create a security group for the engineers and assign it as eligible for the Owner role. Exclude the emergency administrator account from the Conditional Access policy that enforces MFA for administrative portals.Cevap
  3. C
    Create a Microsoft Entra ID security group for the auditors and assign it as active for the Reader role at the management group level using Privileged Identity Management (PIM) for Azure resources, configuring approval and MFA requirements on activation. Create a security group for the engineers and assign it as active for the Owner role. Exclude the emergency administrator account from the Conditional Access policy that enforces MFA for administrative portals.
  4. D
    Create a Microsoft Entra ID security group for the auditors and assign it as eligible for the Reader role at the management group level using Privileged Identity Management (PIM) for Azure resources, configuring approval and MFA requirements on activation. Create a security group for the engineers and assign it as eligible for the Owner role. Enforce MFA for all administrative access, including the emergency administrator account, via a Conditional Access policy with no exclusions.

Cevap

Create a Microsoft Entra ID security group for the auditors and assign it as eligible for the Reader role at the management group level using Privileged Identity Management (PIM) for Azure resources, configuring approval and MFA requirements on activation. Create a security group for the engineers and assign it as eligible for the Owner role. Exclude the emergency administrator account from the Conditional Access policy that enforces MFA for administrative portals.
The correct design uses security groups to assign both the auditors and engineers to their respective roles via Privileged Identity Management (PIM) for Azure resources, which reduces administrative overhead and aligns with the principle of least privilege by keeping assignments eligible rather than active. Additionally, excluding the emergency administrator account from the Conditional Access policy enforcing multi-factor authentication (MFA) prevents tenant lockout during an identity provider outage.

Adım Adım Çözüm

1
Determine the appropriate method for assigning roles to the external security auditors and platform engineers.
Both groups should be assigned roles via Entra security groups (rather than individual accounts) to ensure scalable management and compliance with RBAC best practices.
Assigning roles directly to users increases administrative overhead and violates standard delegation practices.
2
Identify the proper PIM assignment type to satisfy the requirement that daily-use accounts do not have standing privileges and access must be time-bound.
The security groups must be configured as 'eligible' in PIM for Azure Resources, allowing users to activate the roles only when needed (just-in-time access).
Setting the PIM assignments to 'active' gives standing access to the security groups, which defeats the goal of JIT access.
3
Design the Conditional Access policy for administrative access and evaluate the impact on the emergency administrator account.
The emergency administrator account must be excluded from the CA policy requiring MFA.
If the identity provider or MFA service experiences an outage, administrators could be locked out. The emergency account is a critical recovery mechanism and must not require MFA.

Anahtar Kavram

Privileged access management, just-in-time role activation, group-based RBAC, and emergency account governance in Microsoft Entra ID.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Entra ID Governance and Privileged Access