AZ-304 Azure Identity and Access Management Design 2 — Questions and Answers
Question 1: A hybrid organization wants to sync on-premises Active Directory users to Azure AD. Which tool should you deploy?
- Azure AD Connect (Correct answer)
- Azure AD B2B
- ADFS only
- Azure AD Connect Cloud Sync
Correct answer: Azure AD Connect
Azure AD Connect is the primary tool for synchronizing on-premises AD identities, groups, and attributes to Azure AD in a hybrid identity scenario.
Question 2: Which Azure AD feature enables you to define and enforce organizational policies for application access based on conditions like device compliance?
- Access Reviews
- Conditional Access (Correct answer)
- Identity Governance
- Application Proxy
Correct answer: Conditional Access
Conditional Access policies evaluate signals like user location, device compliance, and application sensitivity to grant, block, or require additional verification for access.
Question 3: Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?
- Azure AD B2B
- Azure AD Domain Services
- Azure AD B2C (Correct answer)
- Conditional Access
Correct answer: Azure AD B2C
Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.
Question 4: What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale?
- Direct user assignment
- Dynamic group membership with RBAC assignment (Correct answer)
- Azure Policy assignment
- Attribute-based access control only
Correct answer: Dynamic group membership with RBAC assignment
Using dynamic groups based on user attributes combined with RBAC role assignments to those groups enables scalable, automated access management without manual per-user assignments.
Question 5: An application needs read access to a specific Azure Storage container. Which principle should guide the scope of the role assignment?
- Assign at subscription level for simplicity
- Principle of least privilege — assign at the container level (Correct answer)
- Assign Owner role at resource group level
- Use storage account key instead of RBAC
Correct answer: Principle of least privilege — assign at the container level
The principle of least privilege requires granting only the minimum permissions needed at the narrowest scope, so the role should be assigned at the specific container level.
Question 6: Which Azure AD Access Review feature helps organizations ensure that users still need their current group memberships or application access over time?
- Identity Protection
- Access Reviews (Correct answer)
- Entitlement Management
- PIM role activation
Correct answer: Access Reviews
Access Reviews periodically prompt reviewers or users themselves to confirm whether access is still needed, helping remediate stale permissions and maintain compliance.
AZ-304 Azure Identity and Access Management Design 2
A hybrid organization wants to sync on-premises Active Directory users to Azure AD.
Which tool should you deploy?