Identity & Security Solutions Flashcards
6 cards from real AZ-301 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Identity & Security Solutions flashcards as text
A company wants to implement zero-trust network access for their Azure resources and require that all service-to-service authentication uses managed identities. Which type of managed identity should be used when multiple VMs need to share the same identity?
Answer: User-assigned managed identity
User-assigned managed identities are standalone Azure resources that can be shared across multiple VMs or services, unlike system-assigned which are tied to a single resource.
An architect needs to implement privileged access management for Azure resources, requiring just-in-time access with approval workflows and access reviews. Which Azure AD feature should be used?
Answer: Azure AD Privileged Identity Management
Azure AD Privileged Identity Management (PIM) provides just-in-time privileged access with approval workflows, time-bound assignments, and access reviews.
A security architect must ensure that Azure AD sign-ins from risky locations or flagged users automatically require MFA or are blocked. Which Azure AD feature implements this risk-based policy?
Answer: Azure AD Identity Protection with Conditional Access
Azure AD Identity Protection detects sign-in risks and integrates with Conditional Access to automatically enforce MFA or block access based on risk level.
An organization needs to provide external partners with access to their Azure resources using the partners' own Azure AD credentials without creating guest accounts. Which Azure AD feature enables this?
Answer: Azure AD B2B Collaboration
Azure AD B2B Collaboration allows external partners to access your resources using their own organizational credentials via trust relationships.
When designing RBAC for Azure resources, an architect needs to create a custom role that allows reading and writing to Azure Storage blobs but not deleting them. Which scope should minimize the blast radius?
Answer: Resource scope
Assigning the custom role at the resource scope (specific storage account) minimizes the blast radius by limiting permissions to only that specific resource.
A company requires that Azure Key Vault secrets and certificates are only accessible to specific Azure services running within a virtual network, without exposing the Key Vault to the public internet. Which feature should be configured?
Answer: Azure Private Endpoint for Key Vault
Azure Private Endpoint creates a private network interface for Key Vault within your VNet, making it accessible only through private IP without public internet exposure.