AZ-301 Identity & Security Solutions 1 — Questions and Answers
Question 1: A company wants to implement zero-trust network access for their Azure resources and require that all service-to-service authentication uses managed identities. Which type of managed identity should be used when multiple VMs need to share the same identity?
- System-assigned managed identity
- User-assigned managed identity (Correct answer)
- Service principal with certificate
- Azure AD application identity
Correct answer: User-assigned managed identity
User-assigned managed identities are standalone Azure resources that can be shared across multiple VMs or services, unlike system-assigned which are tied to a single resource.
Question 2: An architect needs to implement privileged access management for Azure resources, requiring just-in-time access with approval workflows and access reviews. Which Azure AD feature should be used?
- Azure AD Conditional Access
- Azure AD Privileged Identity Management (Correct answer)
- Azure Role-Based Access Control
- Azure AD Identity Protection
Correct answer: Azure AD Privileged Identity Management
Azure AD Privileged Identity Management (PIM) provides just-in-time privileged access with approval workflows, time-bound assignments, and access reviews.
Question 3: A security architect must ensure that Azure AD sign-ins from risky locations or flagged users automatically require MFA or are blocked. Which Azure AD feature implements this risk-based policy?
- Azure AD Multi-Factor Authentication
- Azure AD Identity Protection with Conditional Access (Correct answer)
- Azure AD Application Proxy
- Azure AD B2C
Correct answer: Azure AD Identity Protection with Conditional Access
Azure AD Identity Protection detects sign-in risks and integrates with Conditional Access to automatically enforce MFA or block access based on risk level.
Question 4: An organization needs to provide external partners with access to their Azure resources using the partners' own Azure AD credentials without creating guest accounts. Which Azure AD feature enables this?
- Azure AD B2B Collaboration (Correct answer)
- Azure AD B2C
- Azure AD External Identities Direct Federation
- Azure AD Application Proxy
Correct answer: Azure AD B2B Collaboration
Azure AD B2B Collaboration allows external partners to access your resources using their own organizational credentials via trust relationships.
Question 5: When designing RBAC for Azure resources, an architect needs to create a custom role that allows reading and writing to Azure Storage blobs but not deleting them. Which scope should minimize the blast radius?
- Management Group scope
- Subscription scope
- Resource Group scope
- Resource scope (Correct answer)
Correct answer: Resource scope
Assigning the custom role at the resource scope (specific storage account) minimizes the blast radius by limiting permissions to only that specific resource.
Question 6: A company requires that Azure Key Vault secrets and certificates are only accessible to specific Azure services running within a virtual network, without exposing the Key Vault to the public internet. Which feature should be configured?
- Key Vault access policies
- Azure Private Endpoint for Key Vault (Correct answer)
- Key Vault firewall with trusted services
- Managed HSM
Correct answer: Azure Private Endpoint for Key Vault
Azure Private Endpoint creates a private network interface for Key Vault within your VNet, making it accessible only through private IP without public internet exposure.
AZ-301 Identity & Security Solutions 1
A company wants to implement zero-trust network access for their Azure resources and require that all service-to-service authentication uses managed identities.
Which type of managed identity should be used when multiple VMs need to share the same identity?