AZ-304 Azure Identity and Access Management Design 3

Question 1

Which Azure service allows you to extend your on-premises Active Directory domain to Azure virtual machines without deploying domain controllers?

Accepted Answer

Azure AD Domain Services

Answer

Azure AD Domain Services provides managed domain services (LDAP, Kerberos, NTLM) without requiring you to deploy, manage, or patch domain controllers.

Question 2

You need to enforce that all administrator accounts in your organization use phishing-resistant MFA. Which Azure AD policy type should you configure?

Accepted Answer

Conditional Access policy with authentication strength

Answer

Conditional Access with Authentication Strength allows you to require specific MFA methods (e.g., FIDO2, Certificate-based) for privileged roles, enforcing phishing-resistant authentication.

Question 3

What is the maximum number of objects that can be synchronized from on-premises AD to Azure AD Connect with a single Azure AD tenant?

Accepted Answer

No hard limit — scales to millions

Answer

Azure AD Connect has no fixed upper limit for the number of synchronized objects; the Azure AD tenant itself can hold up to 500,000 objects by default, expandable on request.

Question 4

Which identity model allows users to sign in to Azure resources using the same credentials as their on-premises AD without password hash sync to Azure AD?

Accepted Answer

Federation with ADFS

Answer

Federation with ADFS redirects authentication to on-premises ADFS servers so credentials are validated locally and never sent to Azure AD, which is the model that avoids password hash sync.

Question 5

Which Azure AD feature enables employees to request access packages containing multiple resource access rights (groups, apps, SharePoint) through a self-service portal?

Accepted Answer

Entitlement Management

Answer

Entitlement Management lets you bundle access to multiple resources into access packages that users can request through a governed, approval-based self-service portal.

AZ-304 - Microsoft Azure Architect Design Practice Test

AZ-304 - Microsoft Azure Architect Design Practice Test

AZ-304 Azure Identity and Access Management Design 3