Describe Azure Identity, Access, and Security AZ-900 Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is a layer in the defense-in-depth model?

   • AMarketing
   • BPricing
   • CData
   • DBranding
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company has an on-premises Active Directory environment and wants to use the same user credentials to access Azure resources and Microsoft 365. The company does not want to maintain a separate identity store in the cloud. What should you implement?

   • AMicrosoft Entra Domain Services and join all Azure resources to the managed domain.
   • BMicrosoft Entra ID with password hash synchronization from on-premises Active Directory.
   • CA site-to-site VPN so that Azure resources are on the same network as the on-premises domain controllers.
   • DMicrosoft Defender for Cloud to monitor on-premises Active Directory and replicate users to Azure.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company has a Microsoft Entra ID tenant and an on-premises Active Directory. They want to use the same user accounts for both environments, but they have a strict security requirement that passwords must never be stored in the cloud. They also want to enable SSO for cloud applications. What should they implement?

   • AFederation with Active Directory Federation Services (AD FS), which keeps passwords on-premises and provides SSO to cloud apps.
   • BPassword hash synchronization, which synchronizes password hashes to Entra ID.
   • CMicrosoft Entra Domain Services, which provides a managed domain in the cloud.
   • DPass-through authentication, which validates passwords on-premises but still stores some password information in the cloud.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In Azure RBAC, what does a role definition specify?

   • AThe network configuration of a virtual network
   • BThe pricing tier of an Azure subscription
   • CThe physical location of Azure data centers
   • DA set of permissions, such as read, write, and delete, that can be assigned to a security principal
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company is designing a defense-in-depth strategy for a multi-tier application. The web tier is publicly accessible, the application tier is internal, and the database tier is highly sensitive. The security team wants to ensure that a compromise of the web tier does not lead to database access. They also want to detect and respond to attacks. What should they implement?

   • AA single network security group that allows all internal traffic, and rely on the database's built-in firewall.
   • BNetwork security groups that allow only the application tier to communicate with the database tier, and Microsoft Defender for Cloud for threat detection.
   • CMicrosoft Entra ID with MFA for all users, and Conditional Access policies for the application.
   • DAzure RBAC roles that grant the web tier permission to access the database directly.
   Reveal Solution Discussion Select an answer first