AZ-305 Azure Identity and Access Management Design 1 — Questions and Answers
Question 1: A company needs to allow users from a partner organization to access Azure resources without creating new accounts. Which Azure AD feature should you recommend?
- Azure AD B2C
- Azure AD B2B collaboration (Correct answer)
- Azure AD Domain Services
- Azure AD Connect
Correct answer: Azure AD B2B collaboration
Azure AD B2B collaboration lets you invite external users from partner organizations to access your Azure resources using their existing identities.
Question 2: Your organization requires that administrative actions on Azure resources be performed only after a second approval is obtained. Which Azure feature fulfills this requirement?
- Azure Policy
- Privileged Identity Management (PIM) with approval workflows (Correct answer)
- Conditional Access
- Azure Blueprints
Correct answer: Privileged Identity Management (PIM) with approval workflows
PIM approval workflows require a designated approver to authorize role activation before an admin can perform privileged actions.
Question 3: You need to enforce that all users signing in from outside the corporate network must use MFA. Which solution should you design?
- Azure AD Identity Protection risk policies
- Conditional Access policies with location-based conditions (Correct answer)
- Azure AD Password Protection
- Multi-Tenant Azure AD
Correct answer: Conditional Access policies with location-based conditions
Conditional Access policies can target named locations to require MFA only when users authenticate from outside trusted IP ranges.
Question 4: A solution requires managing access to hundreds of Azure resources for groups of users whose membership changes frequently. Which approach minimizes administrative overhead?
- Assign RBAC roles directly to each user
- Use Azure AD groups with RBAC role assignments (Correct answer)
- Create a separate subscription per user group
- Use Azure Policy for identity management
Correct answer: Use Azure AD groups with RBAC role assignments
Assigning RBAC roles to Azure AD groups means you only manage group membership rather than updating individual role assignments as users change.
Question 5: Your organization runs a legacy application that uses LDAP for authentication. You want to migrate it to Azure without rewriting the app. Which service should you use?
- Azure AD B2C
- Azure Active Directory Domain Services (Azure AD DS) (Correct answer)
- Azure AD Connect
- Azure AD External Identities
Correct answer: Azure Active Directory Domain Services (Azure AD DS)
Azure AD DS provides managed domain services including LDAP, Kerberos, and NTLM so legacy apps can authenticate without code changes.
Question 6: You need to design a solution where service-to-service authentication happens without storing credentials in code or configuration files. Which approach is recommended?
- Store credentials in Azure Key Vault secrets and retrieve them at runtime
- Use Azure Managed Identities (Correct answer)
- Create a shared service principal with a certificate
- Use Azure AD B2B for service accounts
Correct answer: Use Azure Managed Identities
Managed Identities eliminate the need to manage credentials by providing Azure resources with an automatically managed identity in Azure AD.
AZ-305 Azure Identity and Access Management Design 1
A company needs to allow users from a partner organization to access Azure resources without creating new accounts.
Which Azure AD feature should you recommend?