Design Authentication and Authorization Solutions AZ-305 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has an on-premises application that uses Windows Integrated Authentication. They are moving the application to Azure VMs and want to use Azure AD for authentication. The application requires Kerberos authentication. The company does not want to manage domain controllers. What should you recommend?

   • ADeploy Azure AD Domain Services and join the Azure VMs to the managed domain.
   • BUse Azure AD Application Proxy to publish the application.
   • CUse Azure AD Pass-through Authentication and configure the application to use it.
   • DSet up a site-to-site VPN and join the Azure VMs to the on-premises domain.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has a security operations team that needs to review and approve requests for elevated access to Azure resources. The company uses Azure AD PIM. You need to configure PIM to require approval for role activations. What should you do?

   • AIn Azure AD, create a conditional access policy that requires approval for privileged role activation.
   • BIn PIM, configure the role settings to require approval and select the security operations team as approvers.
   • CIn PIM, assign the security operations team the Privileged Role Administrator role.
   • DIn Azure AD, assign the security operations team the User Access Administrator role.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a valid verification method that can be used with Azure AD Multi-Factor Authentication?

   • AAzure Key Vault access policy
   • BAzure AD Connect sync schedule
   • CAzure Policy assignment
   • DMicrosoft Authenticator app notification
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A user needs to be able to create and manage virtual machines in a resource group, but not delete the resource group itself. Which RBAC role should be assigned?

   • AContributor
   • BReader
   • CVirtual Machine Contributor
   • DOwner
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has several Azure subscriptions. A team of administrators needs to manage resources across all subscriptions, but they should only have elevated access when they request it and for a limited time. You need to implement a solution that provides just-in-time access and requires approval for the elevated role. What should you configure?

   • AUse Azure AD conditional access to require MFA when administrators sign in to the Azure portal.
   • BAssign the administrators the Global Administrator role in Azure AD and instruct them to use Azure AD access reviews.
   • CCreate a management group containing all subscriptions and assign the administrators the Contributor role at the management group scope.
   • DAssign the administrators a custom role with permissions to all subscriptions and require them to use Azure AD Privileged Identity Management (PIM) to activate the role.
   Reveal Solution Discussion Select an answer first