AZ-300 Azure Identity & Security 1 — Questions and Answers
Question 1: Which Azure AD feature allows you to control access to applications based on user, device, location, and risk signals?
- Multi-Factor Authentication
- Privileged Identity Management
- Conditional Access (Correct answer)
- Identity Protection
Correct answer: Conditional Access
Conditional Access policies evaluate signals like user identity, device compliance, and location to grant, block, or require additional verification for app access.
Question 2: What is the purpose of Azure AD Privileged Identity Management (PIM)?
- Manage password resets
- Provide just-in-time elevation of privileged roles with approval and time limits (Correct answer)
- Sync on-premises AD with Azure AD
- Monitor sign-in risk
Correct answer: Provide just-in-time elevation of privileged roles with approval and time limits
PIM enables just-in-time privileged access, requiring users to activate elevated roles for a limited time with optional approval and MFA.
Question 3: Which Azure RBAC role allows full management of all Azure resources but does not allow assignment of roles to others?
- Owner
- Contributor (Correct answer)
- Reader
- User Access Administrator
Correct answer: Contributor
The Contributor role grants full create/read/update/delete access to resources but cannot assign Azure roles to others — that requires Owner or User Access Administrator.
Question 4: What is a Managed Identity in Azure?
- A third-party identity provider
- An Azure AD identity automatically managed by Azure for authenticating to services without credentials in code (Correct answer)
- A service account with a password
- A federated enterprise identity
Correct answer: An Azure AD identity automatically managed by Azure for authenticating to services without credentials in code
Managed Identities provide Azure resources with an automatically rotated identity in Azure AD, allowing them to authenticate to other Azure services without storing credentials.
Question 5: Which Azure service stores secrets, keys, and certificates with hardware security module (HSM) backing and fine-grained access control?
- Azure Active Directory
- Azure Key Vault (Correct answer)
- Azure Security Center
- Azure Policy
Correct answer: Azure Key Vault
Azure Key Vault securely stores and manages secrets, encryption keys, and certificates, with optional HSM-backed key protection and RBAC-based access control.
Question 6: Which Azure AD feature detects risky sign-ins and compromised user accounts using machine learning and threat intelligence?
- Conditional Access
- Identity Protection (Correct answer)
- Privileged Identity Management
- Access Reviews
Correct answer: Identity Protection
Azure AD Identity Protection uses ML-based risk detection to identify compromised accounts and risky sign-in behaviors, triggering automated remediation policies.
AZ-300 Azure Identity & Security 1
Which Azure AD feature allows you to control access to applications based on user, device, location, and risk signals?