MCSD Authentication, Authorization & Identity 2

Question 1

Azure AD B2C is best suited for which scenario?

Accepted Answer

Providing consumer-facing identity management with social and local account sign-in

Answer

Managing employee access to internal enterprise applications

Answer

Federating multiple on-premises Active Directory forests

Answer

Synchronizing identities between Azure AD tenants

Question 2

In Azure Role-Based Access Control (RBAC), which built-in role grants full access to manage all resources but does NOT allow the user to assign roles to others?

Accepted Answer

Contributor

Answer

Owner

Answer

User Access Administrator

Answer

Reader

Question 3

What is a Managed Identity in Azure, and what problem does it solve?

Accepted Answer

An Azure AD identity assigned to an Azure resource that eliminates the need to store credentials in code

Answer

An identity that replicates across multiple Azure AD tenants automatically

Answer

A shared service account used by multiple Azure services simultaneously

Answer

An identity that is automatically disabled after 90 days of inactivity

Question 4

Which Azure AD Conditional Access policy condition would block access when a user's sign-in risk level is detected as 'High' by Azure AD Identity Protection?

Accepted Answer

Sign-in risk policy with block access action

Answer

User risk policy with block access action

Answer

Named location policy with IP restriction

Answer

Device compliance policy with require compliant device

Question 5

When using the Client Credentials Flow in OAuth 2.0, who or what is authenticated?

Accepted Answer

The application itself using its own credentials (client ID and secret)

Answer

The end user via username and password

Answer

The resource server using a certificate

Answer

The Azure AD tenant using a federation token

Question 6

What is the Microsoft Identity Platform's recommended approach for validating an access token in a Web API?

Accepted Answer

Use the Microsoft.Identity.Web middleware to automatically validate the token's signature, issuer, and audience

Answer

Decrypt the token using the client secret and manually verify the claims

Answer

Send the token back to Azure AD for introspection on every API call

Answer

Compare the token against a locally cached list of valid tokens

Question 7

In Azure AD application permissions, what is the difference between 'Delegated permissions' and 'Application permissions'?

Accepted Answer

Delegated permissions act on behalf of a signed-in user; Application permissions act as the application without a user context

Answer

Delegated permissions are for admins only; Application permissions are for standard users

Answer

Delegated permissions expire after 1 hour; Application permissions are permanent

Answer

Delegated permissions require client secrets; Application permissions require certificates