Examkin

Soru

Zorluk: OrtaAzure RBAC and Subscription Governance

A logistics company is setting up a new Azure environment. The security team requires that a specific group of external systems administrators be allowed to restart virtual machines and read resource logs within a dedicated resource group named 'rg-shipping-prod'. The access model must enforce the principle of least privilege, facilitate simplified auditing, and support temporary access elevation when troubleshooting critical incidents.

Which two configurations should you include in the governance design? (Select two.)

  1. Assign the Virtual Machine Contributor and Monitoring Reader roles to a Microsoft Entra ID security group at the 'rg-shipping-prod' resource group scope.Cevap
  2. B
    Assign the Virtual Machine Contributor and Monitoring Reader roles directly to each individual external systems administrator's user account at the resource group scope.
  3. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the administrators eligible for membership in the security group.Cevap
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the administrators permanently active members of the security group.

Cevap

The correct configurations are to assign the Virtual Machine Contributor and Monitoring Reader roles to a Microsoft Entra ID security group at the 'rg-shipping-prod' resource group scope, and to configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the administrators eligible for membership in that security group.
To implement secure governance under the principle of least privilege and support temporary access, permissions should be assigned to a Microsoft Entra ID security group scoped specifically to the target resource group. Using Microsoft Entra Privileged Identity Management (PIM) for Groups with an eligible assignment ensures that administrators can elevate their permissions just-in-time when troubleshooting is required, rather than maintaining standing privileges.

Adım Adım Çözüm

1
Determine the identity assignment method.
Create a Microsoft Entra ID security group and add the external administrators to it, rather than assigning roles directly to individual accounts.
This simplifies auditing and follows the standard governance best practice of group-based access control.
2
Determine the role assignment scope and roles.
Assign the Virtual Machine Contributor and Monitoring Reader roles at the 'rg-shipping-prod' resource group scope.
This limits permissions to the specific resources required, adhering to the principle of least privilege.
3
Determine the access elevation strategy.
Configure the group in Microsoft Entra Privileged Identity Management (PIM) for Groups with eligible membership assignments.
Eligible membership enables just-in-time (JIT) elevation for troubleshooting incidents, preventing permanently active privileges.

Anahtar Kavram

Azure RBAC and group-based access control combined with Microsoft Entra PIM for secure subscription governance.
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance