A company has a subscription with multiple resource groups. The security team wants to enforce least privilege for a group of developers who need to deploy and manage web apps, but they should not be able to modify network security groups (NSGs) or virtual networks. Which RBAC approach should you use?

Assign the Web Plan Contributor role to the developers at the resource group scope that contains the web apps.

Assign the Website Contributor role to the developers at the subscription scope.

Create a custom role that includes the permissions to manage web apps but excludes network resource permissions, and assign it to the developers at the resource group scope.

Assign the Contributor role to the developers at the subscription scope.

A company has an on-premises application that requires LDAP and Kerberos authentication. They are migrating the application to Azure VMs and want to use their existing Microsoft Entra ID credentials without maintaining domain controllers in Azure. Which service should they use?

Microsoft Entra Domain Services

What is the purpose of Microsoft Entra Conditional Access?

To enforce access policies based on conditions such as user location, device state, and risk level

To automatically create new user accounts when employees join the organization

To provide a backup of all user credentials

To block all access to Azure resources from outside the corporate network

Microsoft Certified:Azure Fundamentals

Domain 2Objective 4

Describe Azure Identity, Access, and Security AZ-900 Practice Questions (Page 7)

Part of the Describe Azure architecture and services domain, which accounts for 35–40% of the AZ-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

Start Intelligent Quiz

45questions here

9free pages

11concepts

35–40%of the exam

Questions 31–35

31foundation · easy
Which of the following is a pillar of the Zero Trust model?
Select an answer first
32expert · hard
A company has a subscription with multiple resource groups. The security team wants to enforce least privilege for a group of developers who need to deploy and manage web apps, but they should not be able to modify network security groups (NSGs) or virtual networks. Which RBAC approach should you use?
Select an answer first
33application · medium
A company has an on-premises application that requires LDAP and Kerberos authentication. They are migrating the application to Azure VMs and want to use their existing Microsoft Entra ID credentials without maintaining domain controllers in Azure. Which service should they use?
Select an answer first
34application · medium
A company wants to eliminate passwords for their employees when accessing Microsoft 365 and other cloud apps. They want to use a method that requires the user to have their phone and use a biometric or PIN to approve sign-in. Which passwordless method should they implement?
Select an answer first
35foundation · easy
What is the purpose of Microsoft Entra Conditional Access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-900

Examers app · Pro

You’ve practiced. Now get ready to pass.

Free practice is the warm‑up. The Examers app turns it into a pass — adaptive quizzing, a visual book, and an honest readiness score for AZ-900.

Exam Coach that reads what you have really answered and picks one thing for tonight
Intelligent Quiz that adapts to your weak areas
Split‑screen Visual Book — learn each concept as you practice
Timed sets & full mock exams that mirror the real thing
Readiness score from real evidence — know when you’re ready

Get exam‑ready See what’s inside

Free practice stays free — always.

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-900” is a trademark of its owner, used for identification only.

Describe Azure Identity, Access, and Security AZ-900 Practice Questions (Page 7)

Questions 31–35

Which of the following is a pillar of the Zero Trust model?

A company has an on-premises application that requires LDAP and Kerberos authentication. They are migrating the application to Azure VMs and want to use their existing Microsoft Entra ID credentials without maintaining domain controllers in Azure. Which service should they use?

A company wants to eliminate passwords for their employees when accessing Microsoft 365 and other cloud apps. They want to use a method that requires the user to have their phone and use a biometric or PIN to approve sign-in. Which passwordless method should they implement?

What is the purpose of Microsoft Entra Conditional Access?

You’ve practiced. Now get ready to pass.

Keep studying — Describe Azure architecture and services