AZ-300 Azure Identity & Security 2 — Questions and Answers
Question 1: What is the difference between Azure AD tenant-level and subscription-level RBAC roles?
- No difference — all roles apply everywhere
- Tenant-level roles manage Azure AD resources; subscription-level roles manage Azure resource access (Correct answer)
- Subscription roles control billing only
- Tenant roles control only users, not resources
Correct answer: Tenant-level roles manage Azure AD resources; subscription-level roles manage Azure resource access
Azure AD roles (e.g., Global Administrator) control identity and directory resources, while Azure RBAC roles (e.g., Contributor) control Azure resource access — they operate independently.
Question 2: Which feature in Azure Key Vault protects against accidental deletion by requiring an additional purge step after a soft delete?
- Soft Delete
- Purge Protection (Correct answer)
- Key Versioning
- Access Policies
Correct answer: Purge Protection
Purge Protection prevents a soft-deleted Key Vault or its objects from being permanently purged for the retention period, protecting against malicious or accidental deletion.
Question 3: What type of Managed Identity is scoped to a single Azure resource and deleted when that resource is deleted?
- User-Assigned Managed Identity
- System-Assigned Managed Identity (Correct answer)
- Service Principal
- Application Registration
Correct answer: System-Assigned Managed Identity
A System-Assigned Managed Identity is tied to the lifecycle of a single Azure resource and is automatically created and deleted with that resource.
Question 4: Which Azure AD feature lets you periodically review and certify user access to applications and Azure roles to enforce least privilege?
- Access Reviews (Correct answer)
- Conditional Access
- Identity Protection
- Just-in-Time Access
Correct answer: Access Reviews
Azure AD Access Reviews allow administrators or resource owners to periodically recertify user access rights, removing unnecessary permissions automatically if not confirmed.
Question 5: What is the purpose of Azure Policy?
- Assign RBAC roles to users
- Enforce organizational standards and assess compliance of Azure resources at scale (Correct answer)
- Monitor sign-in activity
- Manage encryption keys
Correct answer: Enforce organizational standards and assess compliance of Azure resources at scale
Azure Policy evaluates resources against defined rules (policies) and enforces compliance, denying non-compliant deployments or auditing existing resources.
Question 6: Which Azure AD B2C feature allows external customers to use their existing social or enterprise identities to sign in to your applications?
- Azure AD Connect
- Identity Federation / Social Identity Providers (Correct answer)
- Azure AD Domain Services
- Seamless SSO
Correct answer: Identity Federation / Social Identity Providers
Azure AD B2C supports federating with social identity providers (Google, Facebook, etc.) and enterprise IdPs, letting external users sign in with existing accounts.
AZ-300 Azure Identity & Security 2
What is the difference between Azure AD tenant-level and subscription-level RBAC roles?