Microsoft Azure Security Engineer Certification Azure Identity and Access Management 2 — Questions and Answers
Question 1: What is the minimum Azure AD license tier required to create and enforce Conditional Access policies?
- Azure AD Free
- Azure AD Premium P1 (Correct answer)
- Azure AD Premium P2
- Microsoft 365 Business Basic
Correct answer: Azure AD Premium P1
Conditional Access requires Azure AD Premium P1 or higher; P2 adds Identity Protection risk-based policies and PIM.
Question 2: Which Conditional Access session control determines how frequently users must reauthenticate?
- Require MFA
- Sign-in frequency (Correct answer)
- Persistent browser session
- Require compliant device
Correct answer: Sign-in frequency
The Sign-in Frequency session control specifies the time period after which users are asked to sign in again.
Question 3: Which Azure AD feature maintains a global and custom banned password list to block weak or compromised passwords?
- Smart Lockout
- Password Protection (Correct answer)
- Identity Protection
- Credential Guard
Correct answer: Password Protection
Azure AD Password Protection blocks known weak passwords and allows organizations to add custom banned terms.
Question 4: Which Azure AD permission type allows an app to access resources on behalf of a signed-in user?
- Application permissions
- Daemon permissions
- Background service permissions
- Delegated permissions (Correct answer)
Correct answer: Delegated permissions
Delegated permissions let an application act on behalf of a signed-in user and are constrained by that user's own permissions.
Question 5: Which Azure AD log type records authentication events including user, IP address, risk level, and success or failure?
- Azure Advisor recommendations
- Azure AD Audit Logs
- Azure AD Sign-in Logs (Correct answer)
- Microsoft Defender for Cloud alerts
Correct answer: Azure AD Sign-in Logs
Azure AD Sign-in Logs capture all authentication attempts with details on user, location, device, app, and risk signals.
Question 6: Which PIM capability requires designated approvers to authorize a user's request before a privileged role becomes active?
- Conditional Access policy
- Access Review campaign
- PIM approval workflow (Correct answer)
- Identity Protection risk policy
Correct answer: PIM approval workflow
Configuring an approval workflow in PIM role settings means activation requests are held until an approver grants them.
Microsoft Azure Security Engineer Certification Azure Identity and Access Management 2
What is the minimum Azure AD license tier required to create and enforce Conditional Access policies?