AZ-304 Azure Identity and Access Management Design 3

Question 1

Which Azure service allows you to extend your on-premises Active Directory domain to Azure virtual machines without deploying domain controllers?

Accepted Answer

Azure AD Domain Services

Answer

Azure AD Connect

Answer

Azure AD B2B

Answer

Managed Identity

Question 2

You need to enforce that all administrator accounts in your organization use phishing-resistant MFA. Which Azure AD policy type should you configure?

Accepted Answer

Conditional Access policy with authentication strength

Answer

Per-user MFA settings

Answer

Azure Policy

Answer

Security Defaults

Question 3

What is the maximum number of objects that can be synchronized from on-premises AD to Azure AD Connect with a single Azure AD tenant?

Accepted Answer

No hard limit — scales to millions

Answer

50,000

Answer

100,000

Answer

300,000

Question 4

Which identity model allows users to sign in to Azure resources using the same credentials as their on-premises AD without password hash sync to Azure AD?

Accepted Answer

Federation with ADFS

Answer

Password Hash Synchronization

Answer

Pass-through Authentication

Answer

Azure AD Seamless SSO

Question 5

Which Azure AD feature enables employees to request access packages containing multiple resource access rights (groups, apps, SharePoint) through a self-service portal?

Accepted Answer

Entitlement Management

Answer

Access Reviews

Answer

Privileged Identity Management

Answer

Conditional Access

Question 6

A security architect wants to detect when Azure AD accounts are used from anonymous IP addresses or unfamiliar locations. Which feature provides this capability?

Accepted Answer

Azure AD Identity Protection risk detections

Answer

Azure Sentinel only

Answer

Conditional Access named locations only

Answer

Azure Monitor Alerts