AZ-305 Azure Identity and Access Management Design 2 — Questions and Answers
Question 1: Which Azure AD feature would you use to automatically grant or revoke users' access to applications based on their job role attributes?
- Dynamic groups with automatic licensing
- Entitlement Management access packages (Correct answer)
- Azure AD Privileged Identity Management
- Conditional Access policies
Correct answer: Entitlement Management access packages
Entitlement Management access packages bundle resources and define policies for who can request them and how long they retain access.
Question 2: A multi-tenant SaaS application needs to authenticate users from thousands of different Azure AD tenants. What is the recommended design?
- Create guest accounts in a single tenant for all users
- Register the app as a multi-tenant application in Azure AD (Correct answer)
- Deploy a separate Azure AD tenant per customer
- Use Azure AD B2C for all tenants
Correct answer: Register the app as a multi-tenant application in Azure AD
Registering an app as multi-tenant allows users from any Azure AD tenant to consent and sign in without requiring guest account creation.
Question 3: Your security team requires that stale guest accounts be automatically removed after 90 days of inactivity. Which feature enables this?
- Azure AD Conditional Access
- Azure AD Access Reviews (Correct answer)
- Azure Policy guest user restrictions
- Azure AD Identity Protection
Correct answer: Azure AD Access Reviews
Azure AD Access Reviews can be configured to periodically evaluate guest account activity and automatically remove inactive accounts.
Question 4: Which Azure AD license tier is required to use both Privileged Identity Management and Identity Protection features?
- Azure AD Free
- Azure AD Premium P1
- Azure AD Premium P2 (Correct answer)
- Microsoft 365 E3
Correct answer: Azure AD Premium P2
Both PIM and Identity Protection are Azure AD Premium P2 features that require that specific license tier.
Question 5: A company wants to prevent users from enrolling personal devices in Azure AD and require only compliant corporate devices for cloud app access. Which two features should you combine?
- Azure AD Connect + Conditional Access
- Intune device compliance policies + Conditional Access (Correct answer)
- Azure Policy + Azure AD B2C
- Azure AD Domain Services + Group Policy
Correct answer: Intune device compliance policies + Conditional Access
Intune enforces device compliance standards and Conditional Access can then require a compliant device before granting access to cloud apps.
Question 6: You need to design an identity solution for a consumer-facing mobile application where users can sign in with Google or Facebook. Which service is most appropriate?
- Azure AD B2B collaboration
- Azure Active Directory Domain Services
- Azure AD B2C (Correct answer)
- Azure AD External Identities (workforce)
Correct answer: Azure AD B2C
Azure AD B2C is designed for customer-facing applications and supports social identity providers like Google and Facebook out of the box.
AZ-305 Azure Identity and Access Management Design 2
Which Azure AD feature would you use to automatically grant or revoke users' access to applications based on their job role attributes?