AZ-304 Azure Identity and Access Management Design 2

Question 1

A hybrid organization wants to sync on-premises Active Directory users to Azure AD. Which tool should you deploy?

Accepted Answer

Azure AD Connect

Answer

Azure AD Connect is the primary tool for synchronizing on-premises AD identities, groups, and attributes to Azure AD in a hybrid identity scenario.

Question 2

Which Azure AD feature enables you to define and enforce organizational policies for application access based on conditions like device compliance?

Accepted Answer

Conditional Access

Answer

Conditional Access policies evaluate signals like user location, device compliance, and application sensitivity to grant, block, or require additional verification for access.

Question 3

Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?

Accepted Answer

Azure AD B2C

Answer

Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.

Question 4

What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale?

Accepted Answer

Dynamic group membership with RBAC assignment

Answer

Using dynamic groups based on user attributes combined with RBAC role assignments to those groups enables scalable, automated access management without manual per-user assignments.

Question 5

An application needs read access to a specific Azure Storage container. Which principle should guide the scope of the role assignment?

Accepted Answer

Principle of least privilege — assign at the container level

Answer

The principle of least privilege requires granting only the minimum permissions needed at the narrowest scope, so the role should be assigned at the specific container level.

AZ-304 - Microsoft Azure Architect Design Practice Test

AZ-304 - Microsoft Azure Architect Design Practice Test

AZ-304 Azure Identity and Access Management Design 2