Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company hosts its entire server…
This hotspot question tests knowledge of Azure RBAC roles, Azure AD roles, and the principle of least privilege in the context of Contoso's environment spanning two subscriptions and specific technical requirements.
Submitted by carlos_mx· Mar 6, 2026Secure networking
Question
Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company hosts its entire server infrastructure in Azure. Contoso has two Azure subscriptions named Sub1 and Sub2. Both subscriptions are associated to an Azure Active Directory (Azure AD) tenant named contoso.com. Technical requirements Contoso identifies the following technical requirements: Deploy Azure Firewall to VNetWork1 in Sub2. Register an application named App2 in contoso.com. Whenever possible, use the principle of least privilege. Enable Azure AD Privileged Identity Management (PIM) for contoso.com Existing Environment Azure AD Contoso.com contains the users shown in the following table. Contoso.com contains the security groups shown in the following table. Sub1 Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6. User2 creates the virtual networks shown in the following table. Sub1 contains the locks shown in the following table. Sub1 contains the Azure policies shown in the following table. Sub2 Sub2 contains the virtual machines shown in the following table. All virtual machines have the public IP addresses and the Web Server (IIS) role installed. The firewalls for each virtual machine allow ping requests and web requests. Sub2 contains the network security groups (NSGs) shown in the following table. NSG1 has the inbound security rules shown in the following table. NSG2 has the inbound security rules shown in the following table. NSG3 has the inbound security rules shown in the following table. NSG4 has the inbound security rules shown in the following table. NSG1, NSG2, NSG3, and NSG4 have the outbound security rules shown in the following table. Contoso identifies the following technical requirements: Deploy Azure Firewall to VNetwork1 in Sub2. Register an application named App2 in contoso.com. Whenever possible, use the principle of least privilege. Enable Azure AD Privileged Identity Management (PIM) for contoso.com. Hotspot Question You are evaluating the security of VM1, VM2, and VM3 in Sub2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:
Exhibit
Answer Area
From the Internet, you can connect to the web server on VM1 by using HTTP.
From the Internet, you can connect to the web server on VM2 by using HTTP.
From the Internet, you can connect to the web server on VM3 by using HTTP.
Explanation
This hotspot question tests knowledge of Azure RBAC roles, Azure AD roles, and the principle of least privilege in the context of Contoso's environment spanning two subscriptions and specific technical requirements.
Approach. For each scenario presented in the hotspot, you must evaluate the minimum required role that satisfies the technical requirement without granting excessive permissions. For deploying Azure Firewall to VNetWork1 in Sub2, a user needs at least the Network Contributor or a custom role scoped to Sub2. For registering App2 in contoso.com, the user needs the Application Developer or Application Administrator Azure AD role. For enabling Azure AD PIM, the user must hold the Privileged Role Administrator or Global Administrator role in Azure AD. Always match the requirement to the narrowest scope and least-privileged role that fulfills it.
Concept tested. Azure Role-Based Access Control (RBAC), Azure AD roles, and the principle of least privilege - specifically understanding which built-in or Azure AD roles are required for tasks such as deploying network resources, registering applications, and enabling Privileged Identity Management (PIM), while minimizing over-permissioning across subscriptions and Azure AD tenants.
