Microsoft AZ-305 Authorization Architecture Practice Test

 

Topic 04 focuses on Authorization for Azure and Hybrid Resources for the Microsoft Certified: Azure Solutions Architect Expert certification and the AZ-305 exam, using Microsoft Azure solution-architecture scenarios. For broader exam preparation, review the Microsoft Azure Solutions Architect Expert AZ-305 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

When considering Azure custom role, which requirement supports that choice?

1. To refine a role assignment based on resource, request, principal, or environment attributes.
2. To create precise Azure permissions for a specialized job function.
3. To authorize legacy or domain-joined on-premises resources that depend on AD DS.
4. To authorize an application or automation process to access protected resources.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure custom role contains a tailored set of Azure resource actions and data actions when built-in roles do not match required least privilege.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure attribute-based access control conditions, not Azure custom role.

Answer C is incorrect because that outcome is more directly associated with Active Directory Domain Services (AD DS), not Azure custom role.

Answer D is incorrect because that outcome is more directly associated with Service principal, not Azure custom role.

 

Question 2

To control the inheritance boundary of Azure resource permissions, which Azure design option should be selected?

1. Microsoft Entra built-in role
2. Managed identity with Azure RBAC
3. Azure RBAC scope
4. Azure custom role

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure RBAC scope is designed to control the inheritance boundary of Azure resource permissions. Azure RBAC scope defines where a role assignment applies, such as a management group, subscription, resource group, or individual resource.

Incorrect Answers

Answer A is incorrect because Microsoft Entra built-in role can be useful in Azure architectures, but its primary role is to delegate identity and directory administration; it is not the best match for the stated priority.

Answer B is incorrect because Managed identity with Azure RBAC can be useful in Azure architectures, but its primary role is to allow Azure workloads to access resources without embedded secrets; it is not the best match for the stated priority.

Answer D is incorrect because Azure custom role can be useful in Azure architectures, but its primary role is to create precise Azure permissions for a specialized job function; it is not the best match for the stated priority.

 

Question 3

To refine a role assignment based on resource, request, principal, or environment attributes, which Azure design option should be selected?

1. Azure attribute-based access control conditions
2. Managed identity with Azure RBAC
3. Microsoft Entra Domain Services
4. Microsoft Entra built-in role

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure attribute-based access control conditions add attribute-based conditions to supported Azure role assignments to further constrain permitted actions. It directly meets the requirement to refine a role assignment based on resource, request, principal, or environment attributes.

Incorrect Answers

Answer B is incorrect because Managed identity with Azure RBAC is used to allow Azure workloads to access resources without embedded secrets; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Microsoft Entra Domain Services is used to support legacy domain-dependent workloads in Azure with a managed domain; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Microsoft Entra built-in role is used to delegate identity and directory administration; that does not directly satisfy the requirement in this scenario.

 

Question 4

When considering Azure RBAC scope, which requirement supports that choice?

1. To allow Azure workloads to access resources without embedded secrets.
2. To create precise Azure permissions for a specialized job function.
3. To delegate identity and directory administration.
4. To control the inheritance boundary of Azure resource permissions.

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure RBAC scope defines where a role assignment applies, such as a management group, subscription, resource group, or individual resource.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Managed identity with Azure RBAC, not Azure RBAC scope.

Answer B is incorrect because that outcome is more directly associated with Azure custom role, not Azure RBAC scope.

Answer C is incorrect because that outcome is more directly associated with Microsoft Entra built-in role, not Azure RBAC scope.

 

Question 5

An organization wants to delegate identity and directory administration. Which design choice most directly meets the requirement?

1. Microsoft Entra built-in role
2. Azure Arc-enabled servers
3. Active Directory Domain Services (AD DS)
4. Service principal

Correct Answer: A

 

Correct Answer

Answer A is correct because Microsoft Entra built-in role grants administrative permissions over Microsoft Entra directory objects and identity features rather than Azure resource management operations. It directly meets the requirement to delegate identity and directory administration.

Incorrect Answers

Answer B is incorrect because Azure Arc-enabled servers is used to extend Azure management and governance to hybrid servers without changing their primary authentication system; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Active Directory Domain Services (AD DS) is used to authorize legacy or domain-joined on-premises resources that depend on AD DS; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Service principal is used to authorize an application or automation process to access protected resources; that does not directly satisfy the requirement in this scenario.

 

Question 6

To authorize an application or automation process to access protected resources, which Azure design option should be selected?

1. Azure role-based access control (Azure RBAC)
2. Microsoft Entra Domain Services
3. Managed identity with Azure RBAC
4. Service principal

Correct Answer: D

 

Correct Answer

Answer D is correct because Service principal is designed to authorize an application or automation process to access protected resources. Service principal is an application identity in a Microsoft Entra tenant that can receive permissions and authenticate non-human workloads.

Incorrect Answers

Answer A is incorrect because Azure role-based access control (Azure RBAC) can be useful in Azure architectures, but its primary role is to grant least-privilege permissions to Azure resources; it is not the best match for the stated priority.

Answer B is incorrect because Microsoft Entra Domain Services can be useful in Azure architectures, but its primary role is to support legacy domain-dependent workloads in Azure with a managed domain; it is not the best match for the stated priority.

Answer C is incorrect because Managed identity with Azure RBAC can be useful in Azure architectures, but its primary role is to allow Azure workloads to access resources without embedded secrets; it is not the best match for the stated priority.

 

Question 7

To authorize legacy or domain-joined on-premises resources that depend on AD DS, which Azure design option should be selected?

1. Microsoft Entra Domain Services
2. Azure role-based access control (Azure RBAC)
3. Active Directory Domain Services (AD DS)
4. Azure custom role

Correct Answer: C

 

Correct Answer

Answer C is correct because Active Directory Domain Services (AD DS) is designed to authorize legacy or domain-joined on-premises resources that depend on AD DS. Active Directory Domain Services (AD DS) provides traditional domain authentication, Kerberos, NTLM, Group Policy, and directory authorization for on-premises Windows environments.

Incorrect Answers

Answer A is incorrect because Microsoft Entra Domain Services can be useful in Azure architectures, but its primary role is to support legacy domain-dependent workloads in Azure with a managed domain; it is not the best match for the stated priority.

Answer B is incorrect because Azure role-based access control (Azure RBAC) can be useful in Azure architectures, but its primary role is to grant least-privilege permissions to Azure resources; it is not the best match for the stated priority.

Answer D is incorrect because Azure custom role can be useful in Azure architectures, but its primary role is to create precise Azure permissions for a specialized job function; it is not the best match for the stated priority.

 

Question 8

For Microsoft Entra Domain Services, which statement is accurate?

1. Projects non-Azure servers into Azure Resource Manager so governance and selected Azure management capabilities can be applied.
2. Defines where a role assignment applies, such as a management group, subscription, resource group, or individual resource.
3. Provides managed domain services such as domain join, LDAP, Kerberos, and NTLM without deploying domain controllers.
4. Add attribute-based conditions to supported Azure role assignments to further constrain permitted actions.

Correct Answer: C

 

Correct Answer

Answer C is correct because Microsoft Entra Domain Services provides managed domain services such as domain join, LDAP, Kerberos, and NTLM without deploying domain controllers.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure Arc-enabled servers, whose purpose is to extend Azure management and governance to hybrid servers without changing their primary authentication system.

Answer B is incorrect because that description belongs to Azure RBAC scope, whose purpose is to control the inheritance boundary of Azure resource permissions.

Answer D is incorrect because that description belongs to Azure attribute-based access control conditions, whose purpose is to refine a role assignment based on resource, request, principal, or environment attributes.

 

Question 9

To grant least-privilege permissions to Azure resources, which Azure design option should be selected?

1. Service principal
2. Azure RBAC scope
3. Azure attribute-based access control conditions
4. Azure role-based access control (Azure RBAC)

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure role-based access control (Azure RBAC) is designed to grant least-privilege permissions to Azure resources. Azure role-based access control (Azure RBAC) authorizes access to Azure resources by assigning role definitions to security principals at a scope.

Incorrect Answers

Answer A is incorrect because Service principal can be useful in Azure architectures, but its primary role is to authorize an application or automation process to access protected resources; it is not the best match for the stated priority.

Answer B is incorrect because Azure RBAC scope can be useful in Azure architectures, but its primary role is to control the inheritance boundary of Azure resource permissions; it is not the best match for the stated priority.

Answer C is incorrect because Azure attribute-based access control conditions can be useful in Azure architectures, but its primary role is to refine a role assignment based on resource, request, principal, or environment attributes; it is not the best match for the stated priority.

 

Question 10

Which Azure capability provides managed domain services such as domain join, LDAP, Kerberos, and NTLM without deploying domain controllers?

1. Azure RBAC scope
2. Microsoft Entra Domain Services
3. Azure attribute-based access control conditions
4. Azure Arc-enabled servers

Correct Answer: B

 

Correct Answer

Answer B is correct because Microsoft Entra Domain Services matches the described capability and is intended to support legacy domain-dependent workloads in Azure with a managed domain.

Incorrect Answers

Answer A is incorrect because Azure RBAC scope is intended to control the inheritance boundary of Azure resource permissions, which is a different architectural function.

Answer C is incorrect because Azure attribute-based access control conditions is intended to refine a role assignment based on resource, request, principal, or environment attributes, which is a different architectural function.

Answer D is incorrect because Azure Arc-enabled servers is intended to extend Azure management and governance to hybrid servers without changing their primary authentication system, which is a different architectural function.

 

Question 11

For Azure RBAC scope, which statement is accurate?

1. Defines where a role assignment applies, such as a management group, subscription, resource group, or individual resource.
2. Contains a tailored set of Azure resource actions and data actions when built-in roles do not match required least privilege.
3. Combines credential-free Azure-managed workload identity with Azure role assignments.
4. Grants administrative permissions over Microsoft Entra directory objects and identity features rather than Azure resource management operations.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure RBAC scope defines where a role assignment applies, such as a management group, subscription, resource group, or individual resource.

Incorrect Answers

Answer B is incorrect because that description belongs to Azure custom role, whose purpose is to create precise Azure permissions for a specialized job function.

Answer C is incorrect because that description belongs to Managed identity with Azure RBAC, whose purpose is to allow Azure workloads to access resources without embedded secrets.

Answer D is incorrect because that description belongs to Microsoft Entra built-in role, whose purpose is to delegate identity and directory administration.

 

Question 12

When considering Managed identity with Azure RBAC, which requirement supports that choice?

1. To allow Azure workloads to access resources without embedded secrets.
2. To control the inheritance boundary of Azure resource permissions.
3. To extend Azure management and governance to hybrid servers without changing their primary authentication system.
4. To authorize legacy or domain-joined on-premises resources that depend on AD DS.

Correct Answer: A

 

Correct Answer

Answer A is correct because Managed identity with Azure RBAC combines credential-free Azure-managed workload identity with Azure role assignments.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Azure RBAC scope, not Managed identity with Azure RBAC.

Answer C is incorrect because that outcome is more directly associated with Azure Arc-enabled servers, not Managed identity with Azure RBAC.

Answer D is incorrect because that outcome is more directly associated with Active Directory Domain Services (AD DS), not Managed identity with Azure RBAC.

 

Question 13

Which Azure capability authorizes access to Azure resources by assigning role definitions to security principals at a scope?

1. Azure RBAC scope
2. Service principal
3. Azure role-based access control (Azure RBAC)
4. Azure attribute-based access control conditions

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure role-based access control (Azure RBAC) matches the described capability and is intended to grant least-privilege permissions to Azure resources.

Incorrect Answers

Answer A is incorrect because Azure RBAC scope is intended to control the inheritance boundary of Azure resource permissions, which is a different architectural function.

Answer B is incorrect because Service principal is intended to authorize an application or automation process to access protected resources, which is a different architectural function.

Answer D is incorrect because Azure attribute-based access control conditions is intended to refine a role assignment based on resource, request, principal, or environment attributes, which is a different architectural function.

 

Question 14

When considering Azure Arc-enabled servers, which requirement supports that choice?

1. To extend Azure management and governance to hybrid servers without changing their primary authentication system.
2. To delegate identity and directory administration.
3. To create precise Azure permissions for a specialized job function.
4. To grant least-privilege permissions to Azure resources.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Arc-enabled servers projects non-Azure servers into Azure Resource Manager so governance and selected Azure management capabilities can be applied.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Microsoft Entra built-in role, not Azure Arc-enabled servers.

Answer C is incorrect because that outcome is more directly associated with Azure custom role, not Azure Arc-enabled servers.

Answer D is incorrect because that outcome is more directly associated with Azure role-based access control (Azure RBAC), not Azure Arc-enabled servers.

 

Question 15

Which Azure capability add attribute-based conditions to supported Azure role assignments to further constrain permitted actions?

1. Managed identity with Azure RBAC
2. Azure attribute-based access control conditions
3. Microsoft Entra Domain Services
4. Microsoft Entra built-in role

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure attribute-based access control conditions matches the described capability and is intended to refine a role assignment based on resource, request, principal, or environment attributes.

Incorrect Answers

Answer A is incorrect because Managed identity with Azure RBAC is intended to allow Azure workloads to access resources without embedded secrets, which is a different architectural function.

Answer C is incorrect because Microsoft Entra Domain Services is intended to support legacy domain-dependent workloads in Azure with a managed domain, which is a different architectural function.

Answer D is incorrect because Microsoft Entra built-in role is intended to delegate identity and directory administration, which is a different architectural function.

 

Question 16

Which Azure capability contains a tailored set of Azure resource actions and data actions when built-in roles do not match required least privilege?

1. Service principal
2. Azure custom role
3. Active Directory Domain Services (AD DS)
4. Azure attribute-based access control conditions

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure custom role matches the described capability and is intended to create precise Azure permissions for a specialized job function.

Incorrect Answers

Answer A is incorrect because Service principal is intended to authorize an application or automation process to access protected resources, which is a different architectural function.

Answer C is incorrect because Active Directory Domain Services (AD DS) is intended to authorize legacy or domain-joined on-premises resources that depend on AD DS, which is a different architectural function.

Answer D is incorrect because Azure attribute-based access control conditions is intended to refine a role assignment based on resource, request, principal, or environment attributes, which is a different architectural function.

 

Question 17

When considering Microsoft Entra built-in role, which requirement supports that choice?

1. To delegate identity and directory administration.
2. To extend Azure management and governance to hybrid servers without changing their primary authentication system.
3. To authorize an application or automation process to access protected resources.
4. To authorize legacy or domain-joined on-premises resources that depend on AD DS.

Correct Answer: A

 

Correct Answer

Answer A is correct because Microsoft Entra built-in role grants administrative permissions over Microsoft Entra directory objects and identity features rather than Azure resource management operations.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Azure Arc-enabled servers, not Microsoft Entra built-in role.

Answer C is incorrect because that outcome is more directly associated with Service principal, not Microsoft Entra built-in role.

Answer D is incorrect because that outcome is more directly associated with Active Directory Domain Services (AD DS), not Microsoft Entra built-in role.

 

Question 18

When considering Azure attribute-based access control conditions, which requirement supports that choice?

1. To allow Azure workloads to access resources without embedded secrets.
2. To support legacy domain-dependent workloads in Azure with a managed domain.
3. To refine a role assignment based on resource, request, principal, or environment attributes.
4. To delegate identity and directory administration.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure attribute-based access control conditions add attribute-based conditions to supported Azure role assignments to further constrain permitted actions.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Managed identity with Azure RBAC, not Azure attribute-based access control conditions.

Answer B is incorrect because that outcome is more directly associated with Microsoft Entra Domain Services, not Azure attribute-based access control conditions.

Answer D is incorrect because that outcome is more directly associated with Microsoft Entra built-in role, not Azure attribute-based access control conditions.

 

Question 19

For Managed identity with Azure RBAC, which statement is accurate?

1. Provides traditional domain authentication, Kerberos, NTLM, Group Policy, and directory authorization for on-premises Windows environments.
2. Defines where a role assignment applies, such as a management group, subscription, resource group, or individual resource.
3. Projects non-Azure servers into Azure Resource Manager so governance and selected Azure management capabilities can be applied.
4. Combines credential-free Azure-managed workload identity with Azure role assignments.

Correct Answer: D

 

Correct Answer

Answer D is correct because Managed identity with Azure RBAC combines credential-free Azure-managed workload identity with Azure role assignments.

Incorrect Answers

Answer A is incorrect because that description belongs to Active Directory Domain Services (AD DS), whose purpose is to authorize legacy or domain-joined on-premises resources that depend on AD DS.

Answer B is incorrect because that description belongs to Azure RBAC scope, whose purpose is to control the inheritance boundary of Azure resource permissions.

Answer C is incorrect because that description belongs to Azure Arc-enabled servers, whose purpose is to extend Azure management and governance to hybrid servers without changing their primary authentication system.

 

Question 20

For Azure attribute-based access control conditions, which statement is accurate?

1. Add attribute-based conditions to supported Azure role assignments to further constrain permitted actions.
2. Combines credential-free Azure-managed workload identity with Azure role assignments.
3. Grants administrative permissions over Microsoft Entra directory objects and identity features rather than Azure resource management operations.
4. Provides managed domain services such as domain join, LDAP, Kerberos, and NTLM without deploying domain controllers.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure attribute-based access control conditions add attribute-based conditions to supported Azure role assignments to further constrain permitted actions.

Incorrect Answers

Answer B is incorrect because that description belongs to Managed identity with Azure RBAC, whose purpose is to allow Azure workloads to access resources without embedded secrets.

Answer C is incorrect because that description belongs to Microsoft Entra built-in role, whose purpose is to delegate identity and directory administration.

Answer D is incorrect because that description belongs to Microsoft Entra Domain Services, whose purpose is to support legacy domain-dependent workloads in Azure with a managed domain.

 

Question 21

For Active Directory Domain Services (AD DS), which statement is accurate?

1. Provides managed domain services such as domain join, LDAP, Kerberos, and NTLM without deploying domain controllers.
2. Contains a tailored set of Azure resource actions and data actions when built-in roles do not match required least privilege.
3. Authorizes access to Azure resources by assigning role definitions to security principals at a scope.
4. Provides traditional domain authentication, Kerberos, NTLM, Group Policy, and directory authorization for on-premises Windows environments.

Correct Answer: D

 

Correct Answer

Answer D is correct because Active Directory Domain Services (AD DS) provides traditional domain authentication, Kerberos, NTLM, Group Policy, and directory authorization for on-premises Windows environments.

Incorrect Answers

Answer A is incorrect because that description belongs to Microsoft Entra Domain Services, whose purpose is to support legacy domain-dependent workloads in Azure with a managed domain.

Answer B is incorrect because that description belongs to Azure custom role, whose purpose is to create precise Azure permissions for a specialized job function.

Answer C is incorrect because that description belongs to Azure role-based access control (Azure RBAC), whose purpose is to grant least-privilege permissions to Azure resources.

 

Question 22

An on-premises application depends on domain-joined resources and legacy AD-based authorization. Which identity service remains necessary for those dependencies?

1. Azure custom role
2. Microsoft Entra Domain Services
3. Active Directory Domain Services (AD DS)
4. Azure role-based access control (Azure RBAC)

Correct Answer: C

 

Correct Answer

Answer C is correct because Active Directory Domain Services (AD DS) provides traditional domain authentication, Kerberos, NTLM, Group Policy, and directory authorization for on-premises Windows environments. It directly meets the requirement to authorize legacy or domain-joined on-premises resources that depend on AD DS.

Incorrect Answers

Answer A is incorrect because Azure custom role is used to create precise Azure permissions for a specialized job function; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Microsoft Entra Domain Services is used to support legacy domain-dependent workloads in Azure with a managed domain; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure role-based access control (Azure RBAC) is used to grant least-privilege permissions to Azure resources; that does not directly satisfy the requirement in this scenario.

 

Question 23

When considering Azure role-based access control (Azure RBAC), which requirement supports that choice?

1. To refine a role assignment based on resource, request, principal, or environment attributes.
2. To grant least-privilege permissions to Azure resources.
3. To control the inheritance boundary of Azure resource permissions.
4. To authorize an application or automation process to access protected resources.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure role-based access control (Azure RBAC) authorizes access to Azure resources by assigning role definitions to security principals at a scope.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure attribute-based access control conditions, not Azure role-based access control (Azure RBAC).

Answer C is incorrect because that outcome is more directly associated with Azure RBAC scope, not Azure role-based access control (Azure RBAC).

Answer D is incorrect because that outcome is more directly associated with Service principal, not Azure role-based access control (Azure RBAC).

 

Question 24

For Microsoft Entra built-in role, which statement is accurate?

1. Projects non-Azure servers into Azure Resource Manager so governance and selected Azure management capabilities can be applied.
2. Provides traditional domain authentication, Kerberos, NTLM, Group Policy, and directory authorization for on-premises Windows environments.
3. Is an application identity in a Microsoft Entra tenant that can receive permissions and authenticate non-human workloads.
4. Grants administrative permissions over Microsoft Entra directory objects and identity features rather than Azure resource management operations.

Correct Answer: D

 

Correct Answer

Answer D is correct because Microsoft Entra built-in role grants administrative permissions over Microsoft Entra directory objects and identity features rather than Azure resource management operations.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure Arc-enabled servers, whose purpose is to extend Azure management and governance to hybrid servers without changing their primary authentication system.

Answer B is incorrect because that description belongs to Active Directory Domain Services (AD DS), whose purpose is to authorize legacy or domain-joined on-premises resources that depend on AD DS.

Answer C is incorrect because that description belongs to Service principal, whose purpose is to authorize an application or automation process to access protected resources.

 

Question 25

Which Azure capability grants administrative permissions over Microsoft Entra directory objects and identity features rather than Azure resource management operations?

1. Active Directory Domain Services (AD DS)
2. Microsoft Entra built-in role
3. Azure Arc-enabled servers
4. Service principal

Correct Answer: B

 

Correct Answer

Answer B is correct because Microsoft Entra built-in role matches the described capability and is intended to delegate identity and directory administration.

Incorrect Answers

Answer A is incorrect because Active Directory Domain Services (AD DS) is intended to authorize legacy or domain-joined on-premises resources that depend on AD DS, which is a different architectural function.

Answer C is incorrect because Azure Arc-enabled servers is intended to extend Azure management and governance to hybrid servers without changing their primary authentication system, which is a different architectural function.

Answer D is incorrect because Service principal is intended to authorize an application or automation process to access protected resources, which is a different architectural function.