Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

A global financial services firm operates a single-tenant Azure environment structured under a root management group named FinanceRoot. You are designing a delegated administration and governance strategy for a team of external security auditors. The auditors must be able to view policy compliance states and read the configurations of all Key Vaults and Storage Accounts across all current and future subscriptions. The design must adhere to the principle of least privilege, minimize administrative overhead, and ensure that the auditors only have access temporarily when actively performing an audit.

Which strategy should you recommend?

  1. Create a Microsoft Entra security group. Assign the security group to a custom Azure RBAC role at the FinanceRoot management group scope, defining only the necessary read actions. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the security group.Cevap
  2. B
    Configure Microsoft Entra Privileged Identity Management (PIM) for Azure Resources to assign the individual security auditors as eligible members of a custom Azure RBAC role at the FinanceRoot management group scope.
  3. C
    Create a Microsoft Entra security group. Assign the security group to a custom Azure RBAC role at the FinanceRoot management group scope. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to assign the auditors as permanently active members of the security group.
  4. D
    Create a Microsoft Entra security group. Assign the security group the Reader role on each individual Azure subscription. Implement an Azure Policy definition at the FinanceRoot management group scope with a Deny effect to prevent the security group from modifying any resources.

Cevap

The correct strategy is to create a Microsoft Entra security group, assign it to a custom Azure RBAC role at the root management group scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the group.
The correct strategy combines management group scope inheritance, custom RBAC roles for least privilege, security groups for scalable identity administration, and PIM for Groups to enforce JIT access. Assigning the custom role at the FinanceRoot management group ensures automatic inheritance to all child subscriptions. Using a security group avoids direct user assignments, and configuring the auditors as eligible group members in PIM ensures that their access is temporary and must be explicitly activated.

Adım Adım Çözüm

1
Define the scope and inheritance requirements for the auditing permissions.
Determine that assigning the custom role at the root management group (FinanceRoot) scope ensures automatic inheritance to all child subscriptions without administrative overhead.
Management groups provide a hierarchical structure that allows RBAC roles to inherit downward to all current and future child subscriptions.
2
Apply the principle of least privilege and administrative scaling for role assignment.
Create a custom Azure RBAC role with specific read-only actions for Key Vaults and Storage Accounts, and assign it to a Microsoft Entra security group rather than individual users.
Assigning roles to groups instead of individual users simplifies administration and ensures scalability.
3
Configure just-in-time (JIT) access to enforce temporary auditing sessions.
Implement Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the security group, allowing them to activate membership only during audit windows.
PIM for Groups ensures that administrative permissions are not permanently active, mitigating security risks associated with standing access.

Anahtar Kavram

Azure RBAC, Management Group Inheritance, and Microsoft Entra PIM Integration
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance