Task 1.3: Implement governance to enforce security and regulatory compliance

• AAdd a deny assignment for the external account on rg-core instead of removing the role

  Incorrect

  You can't create deny assignments directly; Azure creates them only for features such as deployment stacks.

• BChange the lock to ReadOnly, which lets you delete role assignments

  Incorrect

  A ReadOnly lock blocks more operations than CanNotDelete, not fewer.

• CAsk Microsoft Entra ID to block the account, which removes its Azure role assignments

  Incorrect

  Blocking sign-in doesn't delete the role assignment, which is what the finding asks to remove.

• DRemove the lock, delete the role assignment, and reapply the lock

  Correct

  A cannot-delete lock also prevents deleting Azure RBAC assignments, so the lock has to be lifted for the change.

Locks block operations that seem harmless: a cannot-delete lock on a resource or resource group prevents the deletion of Azure RBAC assignments, and a read-only lock blocks even more. Users with Owner or User Access Administrator have the Microsoft.Authorization/locks/* actions needed to remove and reapply the lock around the approved change.

• ABackup MUA Operator, for the duration of the change

  Correct

  This role allows only the critical operations that the Resource Guard protects and doesn't allow deleting the Resource Guard.

• BBackup MUA Admin, for the duration of the change

  Incorrect

  Backup MUA Admin includes delete permissions on the Resource Guard, so she could remove the protection.

• CContributor, for the duration of the change

  Incorrect

  Contributor on the Resource Guard also includes delete permissions on it.

• DReader, permanently

  Incorrect

  Reader lets her associate the vault with the guard, but not perform protected critical operations.

With multiuser authorization, a backup admin who wants to run a protected critical operation requests access to the Resource Guard. Microsoft recommends that the security admin grant Backup MUA Operator temporarily, because Contributor or Backup MUA Admin would also allow deleting the Resource Guard. The backup admin otherwise needs only Reader on the guard to enable MUA.

• ASecurity Admin on the subscription

  Incorrect

  That role can make changes, which goes beyond read-only.

• BResource Policy Contributor on the subscription

  Incorrect

  That role can change policy definitions and assignments, which an auditor shouldn't do.

• CReader on the subscription

  Correct

  Reader has access to the policy compliance data that the dashboard needs; Security Reader doesn't.

• DSecurity Reader at the management group instead

  Incorrect

  Security Reader still lacks the policy compliance data, at any scope.

The regulatory compliance dashboard reads Azure Policy compliance data. The subscription Reader role has access to that data, but the Security Reader role doesn't.

• AEvery MCSB recommendation offers both Deny and Enforce

  Incorrect

  Deny and Enforce are supported only on a subset of recommendations.

• BDeny prevents a noncompliant resource, such as a storage account, from being created

  Correct

  Deny uses the policy's deny effect to block deployments that don't comply.

• CDeny blocks a noncompliant resource only after the next compliance scan

  Incorrect

  Deny acts on the create request itself, not after a compliance scan.

• DEnforce removes noncompliant resources that already exist

  Incorrect

  Enforce remediates resources upon creation through deployIfNotExists; it doesn't delete resources.

• EEnforce is turned on from the recommendation's details page and uses the deployIfNotExists effect

  Correct

  You can only enforce from the recommendation details page, and it remediates noncompliant resources automatically upon creation.

In Manage recommendations for the MCSB standard you can set a recommendation's effect; Deny blocks noncompliant deployments. Enforce, available only from a recommendation's details page, uses deployIfNotExists to remediate resources upon creation. Both are supported on a subset of recommendations, and recommendations update within their freshness interval of up to 12 hours.

• AChange the effect to deployIfNotExists, which doesn't need an identity

  Incorrect

  deployIfNotExists also runs through the assignment's managed identity and needs the same roles.

• BAssign the assignment's managed identity Storage Account Contributor at the assignment scope

  Correct

  Only portal-created assignments get their roleDefinitionIds roles automatically; for other methods you grant them yourself.

• CGive the deploying user Storage Account Contributor so that remediation runs as that user

  Incorrect

  Remediation always runs as the assignment's managed identity, not as the deploying user.

• DRecreate the assignment with enforcementMode set to DoNotEnforce

  Incorrect

  DoNotEnforce only stops the effect during resource creation or update; it doesn't give the assignment's identity the role remediation needs.

Policy assignments use a managed identity for modify and deployIfNotExists remediation, and that identity needs the roles listed in roleDefinitionIds. When you create the assignment in the portal, Azure Policy can grant those roles for you; with any other method, such as Bicep, PowerShell or the CLI, you must grant them, or remediation deployments fail.

• A500

  Incorrect

  The limit is ten times higher.

• B2,000

  Incorrect

  That's the limit for Azure operated by 21Vianet.

• C5,000

  Correct

  A tenant can hold up to 5,000 custom roles.

• DThere's no limit

  Incorrect

  Custom roles are limited per tenant.

Custom roles can be shared between subscriptions that trust the same Microsoft Entra tenant, with a limit of 5,000 custom roles per tenant (2,000 for Azure operated by 21Vianet).

• ANo, enabling immutability is always irreversible

  Incorrect

  Only locking makes it irreversible.

• BYes, because an unlocked immutable vault is reversible

  Correct

  An enabled but unlocked setting can still be disabled.

• COnly after every recovery point has expired

  Incorrect

  An unlocked setting can be disabled at any time.

• DOnly by opening a support case

  Incorrect

  You can change an unlocked setting yourself.

Immutability on a vault can be Disabled, Enabled, or Enabled and locked. Enabling it is reversible; Microsoft recommends locking it once you're satisfied with its impact, and locking is irreversible.

• AThe policy deploys flow logs only to virtual networks created after it's assigned

  Incorrect

  The existing East US virtual networks did get flow logs, so age isn't what decides it.

• BNSG flow logs must be turned off in West US before the policy can deploy

  Incorrect

  Turning off NSG flow logs on the same workloads is recommended to avoid duplicate logging and cost, but it isn't a prerequisite.

• CThe deploy policy works only after the audit flow logs policy is assigned

  Incorrect

  The two built-in policies are assigned separately; neither depends on the other.

• DAn assignment targets one region and needs a storage account in that region

  Correct

  The policy takes the virtual network region, a storage account in that region and that region's Network Watcher as parameters, so West US needs its own assignment.

Two built-in policies manage virtual network flow logs: one audits virtual networks without flow logging, and one, with the DeployIfNotExists effect, deploys a flow log to them. The deploy policy's parameters are a single virtual network region, a storage account in the same region, the Network Watcher instance of that region and a retention period, so you assign it once per region.

• ASecurity Admin

  Correct

  Security Admin has Security Reader's view rights and can also update security policies and dismiss alerts.

• BSecurity Reader

  Incorrect

  Security Reader can view but can't make changes.

• CReader

  Incorrect

  Reader can view resources but can't change security policies.

• DBackup Operator

  Incorrect

  Backup Operator manages backups, not Defender for Cloud policies.

Defender for Cloud uses two specific roles: Security Reader, which can view recommendations, alerts, policy and health but can't make changes, and Security Admin, which can also update security policies and dismiss alerts.