Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

A healthcare provider is deploying a multi-tier clinical application across multiple Azure subscriptions under a single management group. The security operations center (SOC) team must be granted permissions to review and update network security rules on all subnets, but only when actively responding to a security incident. The solution must minimize administrative overhead, adhere to the principle of least privilege, and prevent permanent administrative access. Which configuration should you recommend to meet the requirements?

  1. A
    Create an Azure Policy definition with a Deny effect that blocks all modifications to network security group rules unless the caller is a member of the SOC team, and assign the policy at the management group level.
  2. Create a Microsoft Entra ID group for the SOC analysts. In Microsoft Entra Privileged Identity Management (PIM), configure an eligible assignment for the group to a custom Role-Based Access Control (RBAC) role with network security group rule write permissions, scoped at the management group level.Cevap
  3. C
    In Microsoft Entra Privileged Identity Management (PIM), configure individual eligible assignments for each SOC analyst's user account to a custom Role-Based Access Control (RBAC) role with network security group rule write permissions, scoped at the management group level.
  4. D
    Create a Microsoft Entra ID group for the SOC analysts. In Microsoft Entra Privileged Identity Management (PIM), configure an active assignment for the group to a custom Role-Based Access Control (RBAC) role with network security group rule write permissions, scoped at the management group level, with no expiration.

Cevap

Create a Microsoft Entra ID group for the SOC analysts and configure an eligible assignment for the group to a custom Role-Based Access Control (RBAC) role with network security group rule write permissions scoped at the management group level using Microsoft Entra Privileged Identity Management (PIM).
Creating a Microsoft Entra ID security group for the security analysts minimizes overhead by allowing group-based role assignments. Assigning the custom role at the management group level ensures that permissions inherit down to all child subscriptions. Using Privileged Identity Management (PIM) to configure an eligible assignment provides just-in-time access, which satisfies the auditability and least privilege requirements while preventing permanent administrative rights.

Adım Adım Çözüm

1
Consolidate the target users into a Microsoft Entra ID security group.
Simplifies administration and governance compared to managing individual user assignments.
Reduces operational overhead and ensures scalability.
2
Define a custom Azure RBAC role containing only the necessary permissions, such as Microsoft.Network/networkSecurityGroups/securityRules/*.
Enforces the principle of least privilege by not granting full network contributor rights.
Limits the security analysts' write permissions specifically to network security group rules.
3
Configure an eligible role assignment for the security group at the management group scope using Privileged Identity Management (PIM).
Grants just-in-time access across all subscriptions via inheritance, requiring active justification and preventing permanent access.
Meets the requirement for auditing and ensuring access is only active when responding to an incident.

Anahtar Kavram

Subscription governance and scalable RBAC using Microsoft Entra groups and PIM at the management group level to implement just-in-time administrative access.
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance