Azure Identity and Access Management Design Flashcards

Which Azure AD feature allows you to enforce multi-factor authentication based on user risk and sign-in risk signals?

Answer: Identity Protection

Azure AD Identity Protection uses risk-based policies to automatically enforce MFA or block access when suspicious sign-in signals are detected.

A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend?

Answer: Azure AD B2B

Azure AD B2B allows external users to sign in with their own organizational identities, eliminating the need to manage their credentials in your tenant.

Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy?

Answer: Management Group

Management Groups sit at the top of the Azure RBAC hierarchy, allowing policy and access assignments that cascade down to subscriptions, resource groups, and resources.

You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use?

Answer: Managed Identity

Managed Identities provide Azure services with an automatically managed identity in Azure AD, eliminating the need to store credentials in application code.

What is the purpose of Privileged Identity Management (PIM) in Azure AD?

Answer: To provide just-in-time privileged access to Azure resources

PIM enables just-in-time activation of privileged roles, reducing standing access and requiring justification and approval for elevated permissions.

Which authentication method in Azure AD provides passwordless sign-in using a private key stored on a hardware device?

Answer: FIDO2 security keys

FIDO2 security keys enable passwordless authentication by using cryptographic credentials stored on a physical hardware device, eliminating password-based attacks.