AZ-300 Azure Identity & Security 2

Question 1

What is the difference between Azure AD tenant-level and subscription-level RBAC roles?

Accepted Answer

Tenant-level roles manage Azure AD resources; subscription-level roles manage Azure resource access

Answer

Azure AD roles (e.g., Global Administrator) control identity and directory resources, while Azure RBAC roles (e.g., Contributor) control Azure resource access — they operate independently.

Question 2

Which feature in Azure Key Vault protects against accidental deletion by requiring an additional purge step after a soft delete?

Accepted Answer

Purge Protection

Answer

Purge Protection prevents a soft-deleted Key Vault or its objects from being permanently purged for the retention period, protecting against malicious or accidental deletion.

Question 3

What type of Managed Identity is scoped to a single Azure resource and deleted when that resource is deleted?

Accepted Answer

System-Assigned Managed Identity

Answer

A System-Assigned Managed Identity is tied to the lifecycle of a single Azure resource and is automatically created and deleted with that resource.

Question 4

Which Azure AD feature lets you periodically review and certify user access to applications and Azure roles to enforce least privilege?

Accepted Answer

Access Reviews

Answer

Azure AD Access Reviews allow administrators or resource owners to periodically recertify user access rights, removing unnecessary permissions automatically if not confirmed.

Question 5

What is the purpose of Azure Policy?

Accepted Answer

Enforce organizational standards and assess compliance of Azure resources at scale

Answer

Azure Policy evaluates resources against defined rules (policies) and enforces compliance, denying non-compliant deployments or auditing existing resources.

AZ-300 - Microsoft Azure Solutions Architect Practice Test

AZ-300 - Microsoft Azure Solutions Architect Practice Test

AZ-300 Azure Identity & Security 2