Microsoft AZ-305 Identity Management Architecture Practice Test

 

Topic 03 focuses on Authentication and Identity Management Architecture for the Microsoft Certified: Azure Solutions Architect Expert certification and the AZ-305 exam, using Microsoft Azure solution-architecture scenarios. For broader exam preparation, review the Microsoft Azure Solutions Architect Expert AZ-305 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which Azure capability evaluates identity, device, location, risk, application, and other signals to enforce access policies such as MFA or blocking?

1. Microsoft Entra Connect Sync
2. Password hash synchronization
3. Microsoft Entra multifactor authentication
4. Conditional Access

Correct Answer: D

 

Correct Answer

Answer D is correct because Conditional Access matches the described capability and is intended to apply context-aware access requirements during authentication.

Incorrect Answers

Answer A is incorrect because Microsoft Entra Connect Sync is intended to support hybrid identity by synchronizing on-premises directory objects to the cloud, which is a different architectural function.

Answer B is incorrect because Password hash synchronization is intended to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency, which is a different architectural function.

Answer C is incorrect because Microsoft Entra multifactor authentication is intended to reduce account compromise risk by requiring stronger sign-in verification, which is a different architectural function.

 

Question 2

When considering Federation, which requirement supports that choice?

1. To apply context-aware access requirements during authentication.
2. To support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements.
3. To authenticate external or CI/CD workloads to Azure without long-lived credentials.
4. To let an Azure resource authenticate to other services without storing credentials.

Correct Answer: B

 

Correct Answer

Answer B is correct because Federation redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Conditional Access, not Federation.

Answer C is incorrect because that outcome is more directly associated with Workload identity federation, not Federation.

Answer D is incorrect because that outcome is more directly associated with System-assigned managed identity, not Federation.

 

Question 3

For Conditional Access, which statement is accurate?

1. Evaluates identity, device, location, risk, application, and other signals to enforce access policies such as MFA or blocking.
2. Requires an additional verification factor beyond a password or primary credential.
3. Synchronizes selected identities and attributes from on-premises Active Directory Domain Services to Microsoft Entra ID.
4. Synchronizes a hash derived from an on-premises password hash to Microsoft Entra ID so cloud authentication can occur without contacting on-premises AD for each sign-in.

Correct Answer: A

 

Correct Answer

Answer A is correct because Conditional Access evaluates identity, device, location, risk, application, and other signals to enforce access policies such as MFA or blocking.

Incorrect Answers

Answer B is incorrect because that description belongs to Microsoft Entra multifactor authentication, whose purpose is to reduce account compromise risk by requiring stronger sign-in verification.

Answer C is incorrect because that description belongs to Microsoft Entra Connect Sync, whose purpose is to support hybrid identity by synchronizing on-premises directory objects to the cloud.

Answer D is incorrect because that description belongs to Password hash synchronization, whose purpose is to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency.

 

Question 4

To keep password validation on-premises while still using Microsoft Entra sign-in endpoints, which Azure design option should be selected?

1. Microsoft Entra External ID B2B collaboration
2. Pass-through authentication
3. Federation
4. User-assigned managed identity

Correct Answer: B

 

Correct Answer

Answer B is correct because Pass-through authentication is designed to keep password validation on-premises while still using Microsoft Entra sign-in endpoints. Pass-through authentication validates Microsoft Entra sign-ins against on-premises Active Directory by using lightweight authentication agents.

Incorrect Answers

Answer A is incorrect because Microsoft Entra External ID B2B collaboration can be useful in Azure architectures, but its primary role is to grant controlled collaboration access to partners and other external users; it is not the best match for the stated priority.

Answer C is incorrect because Federation can be useful in Azure architectures, but its primary role is to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements; it is not the best match for the stated priority.

Answer D is incorrect because User-assigned managed identity can be useful in Azure architectures, but its primary role is to share one managed workload identity across multiple resources when lifecycle must be independent; it is not the best match for the stated priority.

 

Question 5

To support hybrid identity by synchronizing on-premises directory objects to the cloud, which Azure design option should be selected?

1. System-assigned managed identity
2. Microsoft Entra Connect Sync
3. Microsoft Entra Cloud Sync
4. Pass-through authentication

Correct Answer: B

 

Correct Answer

Answer B is correct because Microsoft Entra Connect Sync is designed to support hybrid identity by synchronizing on-premises directory objects to the cloud. Microsoft Entra Connect Sync synchronizes selected identities and attributes from on-premises Active Directory Domain Services to Microsoft Entra ID.

Incorrect Answers

Answer A is incorrect because System-assigned managed identity can be useful in Azure architectures, but its primary role is to let an Azure resource authenticate to other services without storing credentials; it is not the best match for the stated priority.

Answer C is incorrect because Microsoft Entra Cloud Sync can be useful in Azure architectures, but its primary role is to provide a simpler cloud-managed synchronization option for supported hybrid identity scenarios; it is not the best match for the stated priority.

Answer D is incorrect because Pass-through authentication can be useful in Azure architectures, but its primary role is to keep password validation on-premises while still using Microsoft Entra sign-in endpoints; it is not the best match for the stated priority.

 

Question 6

For Password hash synchronization, which statement is accurate?

1. Creates an Azure-managed service identity whose lifecycle is tied to a single Azure resource.
2. Allows a workload to exchange a trusted external token for Microsoft Entra access without storing a client secret or certificate.
3. Validates Microsoft Entra sign-ins against on-premises Active Directory by using lightweight authentication agents.
4. Synchronizes a hash derived from an on-premises password hash to Microsoft Entra ID so cloud authentication can occur without contacting on-premises AD for each sign-in.

Correct Answer: D

 

Correct Answer

Answer D is correct because Password hash synchronization synchronizes a hash derived from an on-premises password hash to Microsoft Entra ID so cloud authentication can occur without contacting on-premises AD for each sign-in.

Incorrect Answers

Answer A is incorrect because that description belongs to System-assigned managed identity, whose purpose is to let an Azure resource authenticate to other services without storing credentials.

Answer B is incorrect because that description belongs to Workload identity federation, whose purpose is to authenticate external or CI/CD workloads to Azure without long-lived credentials.

Answer C is incorrect because that description belongs to Pass-through authentication, whose purpose is to keep password validation on-premises while still using Microsoft Entra sign-in endpoints.

 

Question 7

When considering System-assigned managed identity, which requirement supports that choice?

1. To let an Azure resource authenticate to other services without storing credentials.
2. To reduce account compromise risk by requiring stronger sign-in verification.
3. To grant controlled collaboration access to partners and other external users.
4. To share one managed workload identity across multiple resources when lifecycle must be independent.

Correct Answer: A

 

Correct Answer

Answer A is correct because System-assigned managed identity creates an Azure-managed service identity whose lifecycle is tied to a single Azure resource.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Microsoft Entra multifactor authentication, not System-assigned managed identity.

Answer C is incorrect because that outcome is more directly associated with Microsoft Entra External ID B2B collaboration, not System-assigned managed identity.

Answer D is incorrect because that outcome is more directly associated with User-assigned managed identity, not System-assigned managed identity.

 

Question 8

Which Azure capability redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID?

1. Federation
2. System-assigned managed identity
3. Workload identity federation
4. Conditional Access

Correct Answer: A

 

Correct Answer

Answer A is correct because Federation matches the described capability and is intended to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements.

Incorrect Answers

Answer B is incorrect because System-assigned managed identity is intended to let an Azure resource authenticate to other services without storing credentials, which is a different architectural function.

Answer C is incorrect because Workload identity federation is intended to authenticate external or CI/CD workloads to Azure without long-lived credentials, which is a different architectural function.

Answer D is incorrect because Conditional Access is intended to apply context-aware access requirements during authentication, which is a different architectural function.

 

Question 9

An enterprise keeps a specialized external identity provider and wants Azure sign-ins redirected to it for token-based authentication. Which description correctly explains federation?

1. Allows a workload to exchange a trusted external token for Microsoft Entra access without storing a client secret or certificate.
2. Creates an Azure-managed service identity whose lifecycle is tied to a single Azure resource.
3. Evaluates identity, device, location, risk, application, and other signals to enforce access policies such as MFA or blocking.
4. Redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID.

Correct Answer: D

 

Correct Answer

Answer D is correct because Federation redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID.

Incorrect Answers

Answer A is incorrect because that description belongs to Workload identity federation, whose purpose is to authenticate external or CI/CD workloads to Azure without long-lived credentials.

Answer B is incorrect because that description belongs to System-assigned managed identity, whose purpose is to let an Azure resource authenticate to other services without storing credentials.

Answer C is incorrect because that description belongs to Conditional Access, whose purpose is to apply context-aware access requirements during authentication.

 

Question 10

Which Azure capability allows a workload to exchange a trusted external token for Microsoft Entra access without storing a client secret or certificate?

1. Workload identity federation
2. Microsoft Entra Connect Sync
3. Microsoft Entra multifactor authentication
4. Microsoft Entra External ID B2B collaboration

Correct Answer: A

 

Correct Answer

Answer A is correct because Workload identity federation matches the described capability and is intended to authenticate external or CI/CD workloads to Azure without long-lived credentials.

Incorrect Answers

Answer B is incorrect because Microsoft Entra Connect Sync is intended to support hybrid identity by synchronizing on-premises directory objects to the cloud, which is a different architectural function.

Answer C is incorrect because Microsoft Entra multifactor authentication is intended to reduce account compromise risk by requiring stronger sign-in verification, which is a different architectural function.

Answer D is incorrect because Microsoft Entra External ID B2B collaboration is intended to grant controlled collaboration access to partners and other external users, which is a different architectural function.

 

Question 11

Which Azure capability is Microsoft cloud identity and access management service for users, groups, applications, devices, and workloads?

1. Password hash synchronization
2. Microsoft Entra Connect Sync
3. Microsoft Entra ID
4. Federation

Correct Answer: C

 

Correct Answer

Answer C is correct because Microsoft Entra ID matches the described capability and is intended to provide cloud identity, authentication, and access control for Azure and SaaS resources.

Incorrect Answers

Answer A is incorrect because Password hash synchronization is intended to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency, which is a different architectural function.

Answer B is incorrect because Microsoft Entra Connect Sync is intended to support hybrid identity by synchronizing on-premises directory objects to the cloud, which is a different architectural function.

Answer D is incorrect because Federation is intended to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements, which is a different architectural function.

 

Question 12

To provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency, which Azure design option should be selected?

1. Pass-through authentication
2. Workload identity federation
3. Password hash synchronization
4. System-assigned managed identity

Correct Answer: C

 

Correct Answer

Answer C is correct because Password hash synchronization synchronizes a hash derived from an on-premises password hash to Microsoft Entra ID so cloud authentication can occur without contacting on-premises AD for each sign-in. It directly meets the requirement to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency.

Incorrect Answers

Answer A is incorrect because Pass-through authentication is used to keep password validation on-premises while still using Microsoft Entra sign-in endpoints; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Workload identity federation is used to authenticate external or CI/CD workloads to Azure without long-lived credentials; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because System-assigned managed identity is used to let an Azure resource authenticate to other services without storing credentials; that does not directly satisfy the requirement in this scenario.

 

Question 13

To grant controlled collaboration access to partners and other external users, which Azure design option should be selected?

1. Conditional Access
2. Microsoft Entra Cloud Sync
3. Microsoft Entra ID
4. Microsoft Entra External ID B2B collaboration

Correct Answer: D

 

Correct Answer

Answer D is correct because Microsoft Entra External ID B2B collaboration is designed to grant controlled collaboration access to partners and other external users. Microsoft Entra External ID B2B collaboration lets external users access organizational resources by using guest identities and their existing credentials.

Incorrect Answers

Answer A is incorrect because Conditional Access can be useful in Azure architectures, but its primary role is to apply context-aware access requirements during authentication; it is not the best match for the stated priority.

Answer B is incorrect because Microsoft Entra Cloud Sync can be useful in Azure architectures, but its primary role is to provide a simpler cloud-managed synchronization option for supported hybrid identity scenarios; it is not the best match for the stated priority.

Answer C is incorrect because Microsoft Entra ID can be useful in Azure architectures, but its primary role is to provide cloud identity, authentication, and access control for Azure and SaaS resources; it is not the best match for the stated priority.

 

Question 14

When considering Microsoft Entra External ID B2B collaboration, which requirement supports that choice?

1. To grant controlled collaboration access to partners and other external users.
2. To provide cloud identity, authentication, and access control for Azure and SaaS resources.
3. To apply context-aware access requirements during authentication.
4. To provide a simpler cloud-managed synchronization option for supported hybrid identity scenarios.

Correct Answer: A

 

Correct Answer

Answer A is correct because Microsoft Entra External ID B2B collaboration lets external users access organizational resources by using guest identities and their existing credentials.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Microsoft Entra ID, not Microsoft Entra External ID B2B collaboration.

Answer C is incorrect because that outcome is more directly associated with Conditional Access, not Microsoft Entra External ID B2B collaboration.

Answer D is incorrect because that outcome is more directly associated with Microsoft Entra Cloud Sync, not Microsoft Entra External ID B2B collaboration.

 

Question 15

An organization wants to provide cloud identity, authentication, and access control for Azure and SaaS resources. Which design choice most directly meets the requirement?

1. Microsoft Entra Connect Sync
2. Microsoft Entra ID
3. Federation
4. Password hash synchronization

Correct Answer: B

 

Correct Answer

Answer B is correct because Microsoft Entra ID is Microsoft cloud identity and access management service for users, groups, applications, devices, and workloads. It directly meets the requirement to provide cloud identity, authentication, and access control for Azure and SaaS resources.

Incorrect Answers

Answer A is incorrect because Microsoft Entra Connect Sync is used to support hybrid identity by synchronizing on-premises directory objects to the cloud; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Federation is used to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Password hash synchronization is used to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency; that does not directly satisfy the requirement in this scenario.

 

Question 16

An organization needs a cloud identity platform for users, applications, and SaaS access across Azure. Which architectural outcome best explains when Microsoft Entra ID should be recommended?

1. To support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements.
2. To provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency.
3. To support hybrid identity by synchronizing on-premises directory objects to the cloud.
4. To provide cloud identity, authentication, and access control for Azure and SaaS resources.

Correct Answer: D

 

Correct Answer

Answer D is correct because Microsoft Entra ID is Microsoft cloud identity and access management service for users, groups, applications, devices, and workloads.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Federation, not Microsoft Entra ID.

Answer B is incorrect because that outcome is more directly associated with Password hash synchronization, not Microsoft Entra ID.

Answer C is incorrect because that outcome is more directly associated with Microsoft Entra Connect Sync, not Microsoft Entra ID.

 

Question 17

A hybrid identity policy requires each password validation to occur against on-premises infrastructure while users sign in through Microsoft Entra endpoints. Which authentication option fits this policy?

1. Pass-through authentication
2. User-assigned managed identity
3. Microsoft Entra External ID B2B collaboration
4. Federation

Correct Answer: A

 

Correct Answer

Answer A is correct because Pass-through authentication validates Microsoft Entra sign-ins against on-premises Active Directory by using lightweight authentication agents. It directly meets the requirement to keep password validation on-premises while still using Microsoft Entra sign-in endpoints.

Incorrect Answers

Answer B is incorrect because User-assigned managed identity is used to share one managed workload identity across multiple resources when lifecycle must be independent; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Microsoft Entra External ID B2B collaboration is used to grant controlled collaboration access to partners and other external users; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Federation is used to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements; that does not directly satisfy the requirement in this scenario.

 

Question 18

To share one managed workload identity across multiple resources when lifecycle must be independent, which Azure design option should be selected?

1. User-assigned managed identity
2. Workload identity federation
3. Microsoft Entra ID
4. Conditional Access

Correct Answer: A

 

Correct Answer

Answer A is correct because User-assigned managed identity is designed to share one managed workload identity across multiple resources when lifecycle must be independent. User-assigned managed identity creates a reusable Azure-managed service identity that can be attached to multiple supported Azure resources.

Incorrect Answers

Answer B is incorrect because Workload identity federation can be useful in Azure architectures, but its primary role is to authenticate external or CI/CD workloads to Azure without long-lived credentials; it is not the best match for the stated priority.

Answer C is incorrect because Microsoft Entra ID can be useful in Azure architectures, but its primary role is to provide cloud identity, authentication, and access control for Azure and SaaS resources; it is not the best match for the stated priority.

Answer D is incorrect because Conditional Access can be useful in Azure architectures, but its primary role is to apply context-aware access requirements during authentication; it is not the best match for the stated priority.

 

Question 19

Which Azure capability validates Microsoft Entra sign-ins against on-premises Active Directory by using lightweight authentication agents?

1. User-assigned managed identity
2. Federation
3. Pass-through authentication
4. Microsoft Entra External ID B2B collaboration

Correct Answer: C

 

Correct Answer

Answer C is correct because Pass-through authentication matches the described capability and is intended to keep password validation on-premises while still using Microsoft Entra sign-in endpoints.

Incorrect Answers

Answer A is incorrect because User-assigned managed identity is intended to share one managed workload identity across multiple resources when lifecycle must be independent, which is a different architectural function.

Answer B is incorrect because Federation is intended to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements, which is a different architectural function.

Answer D is incorrect because Microsoft Entra External ID B2B collaboration is intended to grant controlled collaboration access to partners and other external users, which is a different architectural function.

 

Question 20

When considering Password hash synchronization, which requirement supports that choice?

1. To let an Azure resource authenticate to other services without storing credentials.
2. To provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency.
3. To authenticate external or CI/CD workloads to Azure without long-lived credentials.
4. To keep password validation on-premises while still using Microsoft Entra sign-in endpoints.

Correct Answer: B

 

Correct Answer

Answer B is correct because Password hash synchronization synchronizes a hash derived from an on-premises password hash to Microsoft Entra ID so cloud authentication can occur without contacting on-premises AD for each sign-in.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with System-assigned managed identity, not Password hash synchronization.

Answer C is incorrect because that outcome is more directly associated with Workload identity federation, not Password hash synchronization.

Answer D is incorrect because that outcome is more directly associated with Pass-through authentication, not Password hash synchronization.

 

Question 21

To support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements, which Azure design option should be selected?

1. Workload identity federation
2. Federation
3. Conditional Access
4. System-assigned managed identity

Correct Answer: B

 

Correct Answer

Answer B is correct because Federation is designed to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements. Federation redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID.

Incorrect Answers

Answer A is incorrect because Workload identity federation can be useful in Azure architectures, but its primary role is to authenticate external or CI/CD workloads to Azure without long-lived credentials; it is not the best match for the stated priority.

Answer C is incorrect because Conditional Access can be useful in Azure architectures, but its primary role is to apply context-aware access requirements during authentication; it is not the best match for the stated priority.

Answer D is incorrect because System-assigned managed identity can be useful in Azure architectures, but its primary role is to let an Azure resource authenticate to other services without storing credentials; it is not the best match for the stated priority.

 

Question 22

Which Azure capability requires an additional verification factor beyond a password or primary credential?

1. Microsoft Entra Cloud Sync
2. Microsoft Entra ID
3. Microsoft Entra multifactor authentication
4. Pass-through authentication

Correct Answer: C

 

Correct Answer

Answer C is correct because Microsoft Entra multifactor authentication matches the described capability and is intended to reduce account compromise risk by requiring stronger sign-in verification.

Incorrect Answers

Answer A is incorrect because Microsoft Entra Cloud Sync is intended to provide a simpler cloud-managed synchronization option for supported hybrid identity scenarios, which is a different architectural function.

Answer B is incorrect because Microsoft Entra ID is intended to provide cloud identity, authentication, and access control for Azure and SaaS resources, which is a different architectural function.

Answer D is incorrect because Pass-through authentication is intended to keep password validation on-premises while still using Microsoft Entra sign-in endpoints, which is a different architectural function.

 

Question 23

An organization wants to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements. Which design choice most directly meets the requirement?

1. Federation
2. System-assigned managed identity
3. Workload identity federation
4. Conditional Access

Correct Answer: A

 

Correct Answer

Answer A is correct because Federation redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID. It directly meets the requirement to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements.

Incorrect Answers

Answer B is incorrect because System-assigned managed identity is used to let an Azure resource authenticate to other services without storing credentials; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Workload identity federation is used to authenticate external or CI/CD workloads to Azure without long-lived credentials; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Conditional Access is used to apply context-aware access requirements during authentication; that does not directly satisfy the requirement in this scenario.

 

Question 24

To reduce account compromise risk by requiring stronger sign-in verification, which Azure design option should be selected?

1. Pass-through authentication
2. Microsoft Entra Cloud Sync
3. Microsoft Entra multifactor authentication
4. Microsoft Entra ID

Correct Answer: C

 

Correct Answer

Answer C is correct because Microsoft Entra multifactor authentication is designed to reduce account compromise risk by requiring stronger sign-in verification. Microsoft Entra multifactor authentication requires an additional verification factor beyond a password or primary credential.

Incorrect Answers

Answer A is incorrect because Pass-through authentication can be useful in Azure architectures, but its primary role is to keep password validation on-premises while still using Microsoft Entra sign-in endpoints; it is not the best match for the stated priority.

Answer B is incorrect because Microsoft Entra Cloud Sync can be useful in Azure architectures, but its primary role is to provide a simpler cloud-managed synchronization option for supported hybrid identity scenarios; it is not the best match for the stated priority.

Answer D is incorrect because Microsoft Entra ID can be useful in Azure architectures, but its primary role is to provide cloud identity, authentication, and access control for Azure and SaaS resources; it is not the best match for the stated priority.

 

Question 25

A hybrid organization wants cloud sign-ins to have minimal dependence on the availability of on-premises authentication servers. Which listed synchronization approach best supports that aim?

1. Workload identity federation
2. Pass-through authentication
3. System-assigned managed identity
4. Password hash synchronization

Correct Answer: D

 

Correct Answer

Answer D is correct because Password hash synchronization is designed to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency. Password hash synchronization synchronizes a hash derived from an on-premises password hash to Microsoft Entra ID so cloud authentication can occur without contacting on-premises AD for each sign-in.

Incorrect Answers

Answer A is incorrect because Workload identity federation can be useful in Azure architectures, but its primary role is to authenticate external or CI/CD workloads to Azure without long-lived credentials; it is not the best match for the stated priority.

Answer B is incorrect because Pass-through authentication can be useful in Azure architectures, but its primary role is to keep password validation on-premises while still using Microsoft Entra sign-in endpoints; it is not the best match for the stated priority.

Answer C is incorrect because System-assigned managed identity can be useful in Azure architectures, but its primary role is to let an Azure resource authenticate to other services without storing credentials; it is not the best match for the stated priority.

 

Question 26

Stolen passwords must not be sufficient by themselves to complete a user’s sign-in. Which Microsoft Entra capability introduces an additional verification requirement?

1. Pass-through authentication
2. Microsoft Entra multifactor authentication
3. Microsoft Entra ID
4. Microsoft Entra Cloud Sync

Correct Answer: B

 

Correct Answer

Answer B is correct because Microsoft Entra multifactor authentication requires an additional verification factor beyond a password or primary credential. It directly meets the requirement to reduce account compromise risk by requiring stronger sign-in verification.

Incorrect Answers

Answer A is incorrect because Pass-through authentication is used to keep password validation on-premises while still using Microsoft Entra sign-in endpoints; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Microsoft Entra ID is used to provide cloud identity, authentication, and access control for Azure and SaaS resources; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Microsoft Entra Cloud Sync is used to provide a simpler cloud-managed synchronization option for supported hybrid identity scenarios; that does not directly satisfy the requirement in this scenario.

 

Question 27

Which Azure capability uses lightweight cloud-managed provisioning agents to synchronize supported on-premises identities to Microsoft Entra ID?

1. Password hash synchronization
2. User-assigned managed identity
3. Federation
4. Microsoft Entra Cloud Sync

Correct Answer: D

 

Correct Answer

Answer D is correct because Microsoft Entra Cloud Sync matches the described capability and is intended to provide a simpler cloud-managed synchronization option for supported hybrid identity scenarios.

Incorrect Answers

Answer A is incorrect because Password hash synchronization is intended to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency, which is a different architectural function.

Answer B is incorrect because User-assigned managed identity is intended to share one managed workload identity across multiple resources when lifecycle must be independent, which is a different architectural function.

Answer C is incorrect because Federation is intended to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements, which is a different architectural function.

 

Question 28

For Microsoft Entra Cloud Sync, which statement is accurate?

1. Redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID.
2. Uses lightweight cloud-managed provisioning agents to synchronize supported on-premises identities to Microsoft Entra ID.
3. Creates a reusable Azure-managed service identity that can be attached to multiple supported Azure resources.
4. Synchronizes a hash derived from an on-premises password hash to Microsoft Entra ID so cloud authentication can occur without contacting on-premises AD for each sign-in.

Correct Answer: B

 

Correct Answer

Answer B is correct because Microsoft Entra Cloud Sync uses lightweight cloud-managed provisioning agents to synchronize supported on-premises identities to Microsoft Entra ID.

Incorrect Answers

Answer A is incorrect because that description belongs to Federation, whose purpose is to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements.

Answer C is incorrect because that description belongs to User-assigned managed identity, whose purpose is to share one managed workload identity across multiple resources when lifecycle must be independent.

Answer D is incorrect because that description belongs to Password hash synchronization, whose purpose is to provide resilient hybrid cloud authentication with minimal on-premises sign-in dependency.

 

Question 29

For Pass-through authentication, which statement is accurate?

1. Redirects authentication to an external or on-premises identity provider that issues trusted tokens to Microsoft Entra ID.
2. Creates a reusable Azure-managed service identity that can be attached to multiple supported Azure resources.
3. Validates Microsoft Entra sign-ins against on-premises Active Directory by using lightweight authentication agents.
4. Lets external users access organizational resources by using guest identities and their existing credentials.

Correct Answer: C

 

Correct Answer

Answer C is correct because Pass-through authentication validates Microsoft Entra sign-ins against on-premises Active Directory by using lightweight authentication agents.

Incorrect Answers

Answer A is incorrect because that description belongs to Federation, whose purpose is to support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements.

Answer B is incorrect because that description belongs to User-assigned managed identity, whose purpose is to share one managed workload identity across multiple resources when lifecycle must be independent.

Answer D is incorrect because that description belongs to Microsoft Entra External ID B2B collaboration, whose purpose is to grant controlled collaboration access to partners and other external users.

 

Question 30

When considering Pass-through authentication, which requirement supports that choice?

1. To support sign-in scenarios that require an existing federated identity provider or specialized authentication requirements.
2. To share one managed workload identity across multiple resources when lifecycle must be independent.
3. To keep password validation on-premises while still using Microsoft Entra sign-in endpoints.
4. To grant controlled collaboration access to partners and other external users.

Correct Answer: C

 

Correct Answer

Answer C is correct because Pass-through authentication validates Microsoft Entra sign-ins against on-premises Active Directory by using lightweight authentication agents.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Federation, not Pass-through authentication.

Answer B is incorrect because that outcome is more directly associated with User-assigned managed identity, not Pass-through authentication.

Answer D is incorrect because that outcome is more directly associated with Microsoft Entra External ID B2B collaboration, not Pass-through authentication.