Microsoft Azure Security Engineer Certification Azure Identity and Access Management 1 — Questions and Answers
Question 1: Which Azure AD feature evaluates sign-in signals such as user location, device, and app to enforce policies like MFA or block access?
- Identity Protection
- Conditional Access (Correct answer)
- Privileged Identity Management
- Access Reviews
Correct answer: Conditional Access
Conditional Access acts as a policy engine that evaluates signals and enforces access controls like requiring MFA or blocking sign-ins.
Question 2: Which Azure AD feature uses machine learning to detect risky sign-ins such as leaked credentials and atypical travel?
- Conditional Access
- Azure Sentinel
- Identity Protection (Correct answer)
- Defender for Identity
Correct answer: Identity Protection
Azure AD Identity Protection uses ML to assign user risk and sign-in risk scores based on behavioral and threat intelligence signals.
Question 3: What is the primary purpose of Azure Privileged Identity Management (PIM)?
- Log all administrator actions
- Enable just-in-time privileged role activation (Correct answer)
- Enforce MFA for all users
- Manage external guest users
Correct answer: Enable just-in-time privileged role activation
PIM enables just-in-time activation of privileged roles so users do not have standing access, reducing the attack surface.
Question 4: Which authentication method is most resistant to real-time phishing attacks because credentials are cryptographically bound to the origin?
- SMS one-time passcode
- Authenticator app TOTP
- FIDO2 security key (Correct answer)
- Email one-time passcode
Correct answer: FIDO2 security key
FIDO2 security keys use origin-bound credentials that cannot be replayed by a phishing site because they are tied to the legitimate domain.
Question 5: Which Azure AD Identity Governance feature allows administrators to periodically certify that user access to resources remains appropriate?
- Conditional Access
- Privileged Identity Management
- Access Reviews (Correct answer)
- Identity Protection
Correct answer: Access Reviews
Access Reviews enable admins or resource owners to run recertification campaigns and revoke stale access assignments.
Question 6: Which type of managed identity has a lifecycle independent of any single Azure resource and can be assigned to multiple services?
- System-assigned managed identity
- Service principal
- User-assigned managed identity (Correct answer)
- Federated identity credential
Correct answer: User-assigned managed identity
User-assigned managed identities are standalone Azure resources that persist independently and can be shared across multiple workloads.
Microsoft Azure Security Engineer Certification Azure Identity and Access Management 1
Which Azure AD feature evaluates sign-in signals such as user location, device, and app to enforce policies like MFA or block access?