AZ-305 Azure Identity and Access Management Design 3

Question 1

What is the recommended way to assign the same RBAC role to a resource across multiple subscriptions under a management group?

Accepted Answer

Assign the role at the management group scope

Answer

Assign the role at each subscription individually

Answer

Use Azure Policy to enforce role assignments

Answer

Create a custom role scoped to multiple subscriptions

Question 2

A developer needs read access to a specific Azure Storage account but must not have any permissions on other resources in the resource group. Which scope should you use for the role assignment?

Accepted Answer

Resource scope

Answer

Subscription scope

Answer

Resource group scope

Answer

Management group scope

Question 3

You need to design a solution to detect and alert when users sign in from locations that are anomalous for their profile. Which feature should you enable?

Accepted Answer

Azure AD Identity Protection sign-in risk policies

Answer

Conditional Access named locations

Answer

Azure Monitor log alerts

Answer

Microsoft Defender for Cloud

Question 4

Which Azure AD feature allows you to require users to re-authenticate or meet additional controls when accessing highly sensitive applications even if they already have an active session?

Accepted Answer

Conditional Access authentication context

Answer

Azure AD Seamless SSO

Answer

Azure AD Token Lifetime policies

Answer

Azure AD SSPR

Question 5

Your company is implementing a Zero Trust architecture. Which Azure AD capability most directly supports the 'verify explicitly' principle?

Accepted Answer

Conditional Access with device compliance, location, and risk signals

Answer

Azure AD Password Hash Synchronization

Answer

Azure AD Connect cloud sync

Answer

Azure AD Application Proxy

Question 6

A hybrid organization needs users to sign in to on-premises and cloud applications with the same password without syncing password hashes to Azure AD. Which sync method should you choose?

Accepted Answer

Pass-through Authentication (PTA)

Answer

Password Hash Synchronization (PHS)

Answer

Federation with AD FS

Answer

Azure AD Connect cloud sync