AZ-304 Azure Identity and Access Management Design 1 — Questions and Answers
Question 1: Which Azure AD feature allows you to enforce multi-factor authentication based on user risk and sign-in risk signals?
- Conditional Access
- Azure AD B2C
- Azure AD DS
- Identity Protection (Correct answer)
Correct answer: Identity Protection
Azure AD Identity Protection uses risk-based policies to automatically enforce MFA or block access when suspicious sign-in signals are detected.
Question 2: A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend?
- Azure AD B2C
- Azure AD B2B (Correct answer)
- Azure AD DS
- Azure AD Connect
Correct answer: Azure AD B2B
Azure AD B2B allows external users to sign in with their own organizational identities, eliminating the need to manage their credentials in your tenant.
Question 3: Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy?
- Resource Group
- Subscription
- Management Group (Correct answer)
- Resource
Correct answer: Management Group
Management Groups sit at the top of the Azure RBAC hierarchy, allowing policy and access assignments that cascade down to subscriptions, resource groups, and resources.
Question 4: You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use?
- Service Principal with client secret
- Managed Identity (Correct answer)
- Azure AD Application Proxy
- Shared Access Signature
Correct answer: Managed Identity
Managed Identities provide Azure services with an automatically managed identity in Azure AD, eliminating the need to store credentials in application code.
Question 5: What is the purpose of Privileged Identity Management (PIM) in Azure AD?
- To synchronize on-premises AD with Azure AD
- To provide just-in-time privileged access to Azure resources (Correct answer)
- To enforce password complexity policies
- To audit all sign-in events
Correct answer: To provide just-in-time privileged access to Azure resources
PIM enables just-in-time activation of privileged roles, reducing standing access and requiring justification and approval for elevated permissions.
Question 6: Which authentication method in Azure AD provides passwordless sign-in using a private key stored on a hardware device?
- OATH software tokens
- SMS verification
- FIDO2 security keys (Correct answer)
- App passwords
Correct answer: FIDO2 security keys
FIDO2 security keys enable passwordless authentication by using cryptographic credentials stored on a physical hardware device, eliminating password-based attacks.
AZ-304 Azure Identity and Access Management Design 1
Which Azure AD feature allows you to enforce multi-factor authentication based on user risk and sign-in risk signals?