Task 2.3: Design solutions for securing privileged access

• APut domain controllers and application servers in the same management plane with shared admin accounts

  Incorrect

  Sharing accounts lets a compromise of any app server reach the identity systems.

• BSeparate admin accounts per server team, all on the same shared jump servers

  Incorrect

  Shared jump servers let a compromised workload admin's session reach control-plane credentials; the control plane needs its own accounts and devices.

• CTreat the identity systems as the control plane, with separate admin accounts and devices

  Correct

  The control plane is the centralized identity system that governs access to everything else, so its admin access must be separated from management-plane and workload administration.

• DSeparate accounts only for the application servers that hold customer data, while domain controllers keep the shared accounts

  Incorrect

  Data/workload separation alone leaves the control plane exposed through shared accounts.

Microsoft's enterprise access model replaces the older tier model with planes: the data/workload plane holds business value, the management plane manages workloads and infrastructure, and the control plane, based on centralized enterprise identity systems, governs access across the enterprise. Tier 0 expands to become the control plane, which needs its own protected accounts and devices.

• AA Conditional Access policy that requires MFA for the eight accounts

  Incorrect

  MFA strengthens sign-in but leaves the role active all the time.

• BA quarterly review in which a manager confirms that each of the eight Global Administrators still needs the role permanently

  Incorrect

  Reviews check who should keep access but don't remove standing access between reviews.

• CCustom roles with fewer permissions, assigned permanently to each of the eight administrators

  Incorrect

  Narrower roles reduce what each account can do, but the access stays standing, with no approval, justification or expiry.

• DPrivileged Identity Management with eligible assignments, approval and time-limited activation

  Correct

  PIM turns standing roles into eligible ones that are activated just in time, with approval, justification and a maximum duration.

Privileged Identity Management provides time-based and approval-based role activation. Eligible assignments must be activated before use, role settings can require approval, justification and multifactor authentication or a Conditional Access authentication context on activation, and activations expire after a maximum duration.

• AOne emergency account federated through the same identity provider

  Incorrect

  A federated account fails exactly when the identity provider is down.

• BEmergency accounts that require a compliant device like the other administrators, so that they meet the same Conditional Access standard

  Incorrect

  A device requirement could make the accounts unusable during the outage.

• CTwo or more cloud-only onmicrosoft.com accounts with passkeys, excluded from blocking policies

  Correct

  Emergency accounts must not depend on federation or on controls that could fail in the emergency.

• DEmergency accounts that use the same Authenticator method as everyday admins

  Incorrect

  The guidance asks for a method different from other admin accounts.

Microsoft recommends two or more emergency access accounts that are cloud-only, use the *.onmicrosoft.com domain and aren't federated or synchronized. Protect them with a phishing-resistant method such as passkeys (FIDO2) that differs from other admins' methods, and exclude them from Conditional Access policies that block or restrict sign-in.

• AEnable the Permissions Management (CIEM) extension in the Defender CSPM plan

  Correct

  CIEM is part of Defender CSPM and analyzes excessive and unused permissions across Azure, AWS and GCP in one view.

• BBuy Microsoft Entra Permissions Management as the consultant proposes, and connect all three clouds to it

  Incorrect

  It stopped being sold on April 1, 2025, and was retired on November 1, 2025.

• CRun quarterly Microsoft Entra access reviews of the cloud administrator groups

  Incorrect

  Access reviews recertify group memberships, app access and role assignments; they don't analyze unused or excessive permissions inside AWS and Google Cloud IAM.

• DUse Azure Policy to audit AWS and Google Cloud IAM roles

  Incorrect

  Azure Policy doesn't analyze identity entitlements in other clouds.

Microsoft Defender for Cloud includes cloud infrastructure entitlement management (CIEM) in the Defender CSPM plan, with the Permissions Management extension for Azure, AWS and GCP. It continuously analyzes identity configurations and usage to find excessive, unused or misconfigured permissions and recommends right-sizing them, so the consultant's proposal isn't needed.

• AAt least ten, for coverage across time zones

  Incorrect

  More Global Administrators widen the attack surface.

• BEvery member of the IT department

  Incorrect

  That gives unrestricted access far too broadly.

• CExactly one

  Incorrect

  A single admin is a lockout risk; the guidance is fewer than five, plus emergency accounts.

• DFewer than five

  Correct

  Microsoft recommends fewer than five Global Administrators.

Microsoft recommends assigning the Global Administrator role to fewer than five people, because Global Administrators have essentially unrestricted access; an alert card appears when there are five or more.

• ASpecific permissions, over a specific scope, for a specific time

  Correct

  These three aspects define least privilege for a role assignment.

• BDepartment, job title and manager

  Incorrect

  These are directory attributes, not the aspects of a role assignment.

• CLicense, device and location

  Incorrect

  These aren't the three aspects described.

• DPassword length, MFA method and session length for each administrator account

  Incorrect

  These are authentication settings.

Least privilege means granting administrators exactly the permissions they need. Microsoft's guidance says to consider three aspects when assigning a role: a specific set of permissions, over a specific scope, for a specific period of time.

• AOnly the first Global Administrator created in the tenant, because it can't be deleted

  Incorrect

  All permanently assigned administrators are in scope.

• BEvery user permanently assigned an administrator role

  Correct

  The guidance requires MFA for individual users permanently assigned admin roles.

• COnly administrators who sign in from outside the office

  Incorrect

  Location doesn't exempt administrators.

• DOnly service principals

  Incorrect

  The guidance targets individual administrator accounts.

The guidance for securing privileged access asks you to require Microsoft Entra multifactor authentication at sign-in for all individual users permanently assigned to administrator roles such as Global Administrator, Privileged Role Administrator, Exchange Administrator and SharePoint Administrator.

• AEnterprise

  Incorrect

  Enterprise security is the baseline for all users.

• BSpecialized

  Incorrect

  Specialized security is for elevated-impact users, below privileged.

• CStandard

  Incorrect

  Standard isn't one of the named levels.

• DPrivileged

  Correct

  Privileged devices give the highest security, for roles with the most impact.

The guidance defines enterprise, specialized and privileged security levels. Privileged devices provide the highest security and are meant for roles such as IT administrators who can cause the most damage if compromised.