Describe Azure Identity, Access, and Security AZ-900 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is implementing a Zero Trust security model. They have a mix of managed and unmanaged devices accessing corporate resources. They want to enforce the principle of 'never trust, always verify' by requiring continuous verification of device health and user identity. Which combination of controls best aligns with Zero Trust principles?

   • AA single strong password policy and network perimeter firewall.
   • BMicrosoft Entra Domain Services with Kerberos authentication for all apps.
   • CConditional Access policies that require MFA and device compliance, combined with session controls that limit access based on risk.
   • DAssigning all users the Contributor role at the subscription level.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has a resource group containing virtual machines (VMs) used only by the finance team. The finance team members are in a Microsoft Entra ID group named FinanceUsers. A new finance analyst joins the company and is added to FinanceUsers. The analyst can sign in to the Azure portal but cannot see the VMs. You need to grant the analyst the minimum required access to manage (start, stop, and restart) the VMs. What should you do?

   • AAssign the Virtual Machine Contributor role to the FinanceUsers group at the resource group scope.
   • BAssign the Reader role to the FinanceUsers group at the resource group scope.
   • CAssign the Contributor role to the FinanceUsers group at the subscription scope.
   • DAdd the analyst directly to the VM's local Administrators group on each VM.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company wants to implement passwordless authentication for all employees. The security team is evaluating different methods. They have a mix of Windows 10 devices, iOS and Android phones, and some users who work from home without corporate devices. The company wants a phishing-resistant method that works across all device types. What should they choose?

   • AFIDO2 security keys, which are phishing-resistant and can be used on any device with a USB or NFC port.
   • BMicrosoft Authenticator app with phone sign-in, which works on iOS and Android but is not phishing-resistant.
   • CA combination of Windows Hello for Business for Windows devices and FIDO2 keys for mobile devices.
   • DWindows Hello for Business, which is built into Windows 10 and uses biometrics.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A startup has a single Azure subscription. The development team needs to deploy and manage virtual machines in a resource group, but the team should not be able to modify network security groups or access other resource groups. The security team wants least-privilege access. What should you assign to the development team?

   • AThe Owner role scoped to the resource group containing the virtual machines.
   • BThe Contributor role scoped to the specific resource group containing the virtual machines.
   • CThe Reader role scoped to the resource group and a separate custom role allowing virtual machine start and stop.
   • DThe Virtual Machine Contributor role scoped to the subscription.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is designing a defense-in-depth strategy for a web application in Azure. They have already implemented network security groups (NSGs) and Azure Firewall. They want to add a layer that protects the application from web-based attacks such as SQL injection and cross-site scripting. Which Azure service should they add?

   • AAzure Web Application Firewall (WAF) with Azure Front Door or Application Gateway.
   • BAzure DDoS Protection
   • CAzure Policy
   • DMicrosoft Defender for Cloud
   Reveal Solution Discussion Select an answer first