An organization wants to require multi-factor authentication (MFA) for all users accessing Azure AD from outside the corporate network. They also need to ensure that users who are assigned the Global Administrator role must use MFA even when they are on the corporate network. What should you configure?

Configure Azure AD Privileged Identity Management (PIM) to require MFA for role activation, and rely on that for all users.

Use Azure AD Identity Protection to automatically enforce MFA for all users when they are outside the corporate network.

Create a Conditional Access policy that requires MFA for all users when the location is not trusted, and a second policy that requires MFA for Global Administrators.

Enable MFA per-user in Azure AD and set the service settings to require MFA when users are outside the corporate network.

A company wants to require users to provide a second form of verification when signing in from untrusted networks. Which Azure AD feature should be enabled?

Azure AD Multi-Factor Authentication (MFA)

Azure AD Privileged Identity Management (PIM)

A company is planning to migrate its on-premises applications to Azure. The applications use Windows Integrated Authentication and rely on Kerberos. The company wants to minimize changes to the applications and provide a cloud-based identity that supports Kerberos authentication. What should you recommend?

Use Azure AD with application proxy to publish the applications.

Use Azure AD Pass-through Authentication for the applications.

Implement Azure AD Domain Services and join the Azure VMs to the managed domain.

Set up a site-to-site VPN and extend the on-premises domain to Azure.

A company has a storage account that contains sensitive data. A team of data scientists needs to read and write data in the storage account, but they should not be able to delete the storage account or modify its network settings. You need to assign the appropriate RBAC role. What should you do?

Assign the Contributor role at the storage account scope.

Assign the Reader role at the storage account scope.

Assign the Storage Account Contributor role at the storage account scope.

Assign the Storage Blob Data Contributor role at the storage account scope.

Azure Solutions Architect Expert

Domain 1Objective 2

Design Authentication and Authorization Solutions AZ-305 Practice Questions (Page 5)

Part of the Design identity, governance, and monitoring solutions domain, which makes up ~30% of our current practice bank. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

Questions 21–25

21application · medium
An organization wants to require multi-factor authentication (MFA) for all users accessing Azure AD from outside the corporate network. They also need to ensure that users who are assigned the Global Administrator role must use MFA even when they are on the corporate network. What should you configure?
Select an answer first
22foundation · easy
A company wants to require users to provide a second form of verification when signing in from untrusted networks. Which Azure AD feature should be enabled?
Select an answer first
23foundation · easy
Which Azure service provides a site-to-site VPN connection to allow Azure resources to access on-premises network resources securely?
Select an answer first
24application · medium
A company is planning to migrate its on-premises applications to Azure. The applications use Windows Integrated Authentication and rely on Kerberos. The company wants to minimize changes to the applications and provide a cloud-based identity that supports Kerberos authentication. What should you recommend?
Select an answer first
25application · medium
A company has a storage account that contains sensitive data. A team of data scientists needs to read and write data in the storage account, but they should not be able to delete the storage account or modify its network settings. You need to assign the appropriate RBAC role. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-305

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-305” is a trademark of its owner, used for identification only.

Design Authentication and Authorization Solutions AZ-305 Practice Questions (Page 5)

Questions 21–25

A company wants to require users to provide a second form of verification when signing in from untrusted networks. Which Azure AD feature should be enabled?

Which Azure service provides a site-to-site VPN connection to allow Azure resources to access on-premises network resources securely?

A company has a storage account that contains sensitive data. A team of data scientists needs to read and write data in the storage account, but they should not be able to delete the storage account or modify its network settings. You need to assign the appropriate RBAC role. What should you do?

Keep studying — Design identity, governance, and monitoring solutions