Examkin

Soru

Zorluk: KolayAzure RBAC and Subscription Governance

Your company has an Azure subscription containing multiple resource groups. You need to grant administrative permissions to three new IT support engineers to manage virtual machines within a specific resource group. The solution must minimize administrative overhead and follow Azure governance best practices.

Which of the following approaches should you implement?

  1. A
    Assign the Virtual Machine Contributor role directly to each of the three user accounts at the resource group scope.
  2. Create a Microsoft Entra ID group containing the three engineers, and assign the Virtual Machine Contributor role to the group at the resource group scope.Cevap
  3. C
    Create a Microsoft Entra ID group containing the three engineers, and configure a Microsoft Entra Privileged Identity Management (PIM) active assignment that permanently assigns the Virtual Machine Contributor role to the group.
  4. D
    Create an Azure Policy definition with a Deny effect to automatically deploy the Virtual Machine Contributor role assignment for the three engineers when the resource group is created.

Cevap

Create a Microsoft Entra ID group containing the three engineers, and assign the Virtual Machine Contributor role to the group at the resource group scope.
The correct answer is to create a Microsoft Entra ID security group, add the three engineers to the group, and assign the Virtual Machine Contributor role to the group at the resource group scope. This adheres to the Azure governance best practices of group-based access control and the principle of least privilege, while reducing the administrative effort needed to manage access rights.

Adım Adım Çözüm

1
Identify the administrative unit to group the users.
Create a Microsoft Entra ID security group and add the three engineers as members.
Grouping users minimizes administrative overhead and enables scalable access management.
2
Determine the appropriate scope for the role assignment.
Assign permissions at the specific resource group scope rather than the subscription scope.
This enforces the principle of least privilege by ensuring access is limited to only the required resources.
3
Apply the appropriate Azure role to the security group.
Assign the Virtual Machine Contributor role to the created Microsoft Entra ID security group at the resource group scope.
This provides the required administrative permissions to manage virtual machines without using custom roles or individual assignments.

Anahtar Kavram

Group-based role assignments and least privilege scopes are fundamental to Azure RBAC and subscription governance.
Tahmini Süre:45s
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance