MCSD Authentication, Authorization & Identity 2 — Questions and Answers
Question 1: Azure AD B2C is best suited for which scenario?
- Managing employee access to internal enterprise applications
- Providing consumer-facing identity management with social and local account sign-in (Correct answer)
- Federating multiple on-premises Active Directory forests
- Synchronizing identities between Azure AD tenants
Correct answer: Providing consumer-facing identity management with social and local account sign-in
Azure AD B2C (Business-to-Consumer) is designed for customer-facing applications, supporting social identity providers (Google, Facebook) and local accounts with customizable user flows.
Question 2: In Azure Role-Based Access Control (RBAC), which built-in role grants full access to manage all resources but does NOT allow the user to assign roles to others?
- Owner
- Contributor (Correct answer)
- User Access Administrator
- Reader
Correct answer: Contributor
The Contributor role grants full access to create and manage all types of Azure resources but does not allow granting access to others, unlike the Owner role which includes role assignment permissions.
Question 3: What is a Managed Identity in Azure, and what problem does it solve?
- An identity that replicates across multiple Azure AD tenants automatically
- An Azure AD identity assigned to an Azure resource that eliminates the need to store credentials in code (Correct answer)
- A shared service account used by multiple Azure services simultaneously
- An identity that is automatically disabled after 90 days of inactivity
Correct answer: An Azure AD identity assigned to an Azure resource that eliminates the need to store credentials in code
A Managed Identity provides Azure services with an automatically managed identity in Azure AD, enabling secure authentication to services that support Azure AD without storing credentials in code or configuration.
Question 4: Which Azure AD Conditional Access policy condition would block access when a user's sign-in risk level is detected as 'High' by Azure AD Identity Protection?
- User risk policy with block access action
- Sign-in risk policy with block access action (Correct answer)
- Named location policy with IP restriction
- Device compliance policy with require compliant device
Correct answer: Sign-in risk policy with block access action
A Sign-in Risk Conditional Access policy evaluates the real-time risk of a specific sign-in attempt and can block access when the detected sign-in risk level meets the configured threshold (e.g., High).
Question 5: When using the Client Credentials Flow in OAuth 2.0, who or what is authenticated?
- The end user via username and password
- The application itself using its own credentials (client ID and secret) (Correct answer)
- The resource server using a certificate
- The Azure AD tenant using a federation token
Correct answer: The application itself using its own credentials (client ID and secret)
The Client Credentials Flow is a machine-to-machine flow where the application authenticates as itself using its client ID and secret (or certificate), with no user involved in the authentication process.
Question 6: What is the Microsoft Identity Platform's recommended approach for validating an access token in a Web API?
- Decrypt the token using the client secret and manually verify the claims
- Use the Microsoft.Identity.Web middleware to automatically validate the token's signature, issuer, and audience (Correct answer)
- Send the token back to Azure AD for introspection on every API call
- Compare the token against a locally cached list of valid tokens
Correct answer: Use the Microsoft.Identity.Web middleware to automatically validate the token's signature, issuer, and audience
Microsoft.Identity.Web middleware handles token validation automatically by verifying the JWT signature using Azure AD's public keys, checking the issuer, audience, and expiry — the recommended approach for .NET Web APIs.
Question 7: In Azure AD application permissions, what is the difference between 'Delegated permissions' and 'Application permissions'?
- Delegated permissions are for admins only; Application permissions are for standard users
- Delegated permissions act on behalf of a signed-in user; Application permissions act as the application without a user context (Correct answer)
- Delegated permissions expire after 1 hour; Application permissions are permanent
- Delegated permissions require client secrets; Application permissions require certificates
Correct answer: Delegated permissions act on behalf of a signed-in user; Application permissions act as the application without a user context
Delegated permissions allow the application to act on behalf of a signed-in user (the effective permission is the intersection of the user's permissions and the app's permissions), while Application permissions allow the app to act with its own identity and access all instances of a resource.
MCSD Authentication, Authorization & Identity 2
Azure AD B2C is best suited for which scenario?