Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

An enterprise has a single-tenant Azure environment structured under a root Management Group named Contoso-Root. You are designing a subscription governance and access control solution for two groups of users:

1. Auditors: Must have read-only access to all resources and security logs across all current and future subscriptions under the Contoso-Root hierarchy. This access must be restricted to active audit periods, requiring multi-factor authentication (MFA) and administrative approval for each activation.
2. Operations Team: Must be able to restart virtual machines and modify web application settings within a resource group named Prod-RG-01. They must be prevented from modifying any virtual network configurations or deleting network security groups (NSGs) within the resource group.

Which two configurations should you include in the design to meet the requirements while minimizing administrative overhead and adhering to the principle of least privilege?

  1. Create a Microsoft Entra security group for the auditors, and configure an eligible assignment for the Reader and Security Reader roles at the Contoso-Root management group level using Microsoft Entra Privileged Identity Management (PIM).Cevap
  2. Define a custom Azure RBAC role for the Operations team with Microsoft.Compute/virtualMachines/* and Microsoft.Web/sites/* in actions, and assign it to an Operations Microsoft Entra security group at the Prod-RG-01 resource group scope.Cevap
  3. C
    Assign the Reader and Security Reader roles directly to individual auditor user accounts at the Contoso-Root management group level.
  4. D
    Configure permanently active assignments in Microsoft Entra Privileged Identity Management (PIM) for the Auditors group at the individual subscription levels.

Cevap

Create a Microsoft Entra security group for the auditors, configure eligible Reader and Security Reader roles at the management group level using PIM, and define a custom Azure RBAC role for the Operations team with VM and Web App permissions assigned at the resource group scope to a group.
To govern access for the Auditors across all subscriptions, role assignments must be configured at the management group level to leverage scope inheritance. Utilizing Microsoft Entra Privileged Identity Management (PIM) with eligible assignments guarantees that access is just-in-time, multi-factor authenticated, and approved. For the Operations team, creating a custom RBAC role with permissions restricted to compute and web sites, and scoping the assignment to the specific resource group, satisfies the principle of least privilege. Because no network permissions are granted, the operations team is effectively blocked from altering networks or deleting network security groups.

Adım Adım Çözüm

1
Determine the scope and delegation model for the Auditors.
Using the root management group scope ensures permission inheritance to all current and future subscriptions.
This avoids having to manually assign permissions every time a new subscription is created.
2
Select the correct role activation method for the Auditors.
Configure Microsoft Entra PIM with eligible assignments requiring MFA and approval.
This satisfies the security requirement that the access must not be permanent and must require authorization.
3
Define the access control and role structure for the Operations team.
Create a custom RBAC role containing only the necessary compute and web actions, scope it to the target resource group, and assign it to a security group.
This adheres to the principle of least privilege by not granting network permissions, thereby preventing network modifications.

Anahtar Kavram

Azure RBAC delegation and subscription governance using Management Groups, Custom Roles, and Privileged Identity Management (PIM).
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance