Microsoft Azure Fundamentals (AZ-900) Exam Prep: Azure identity, access and security

1. السؤال 1 من 15

   What is Microsoft Entra ID?

   • AA private network connection between an office and Azure
   • BMicrosoft's cloud identity and access management service
   • CA storage service for large amounts of unstructured data
   • DA calculator for estimating the cost of Azure resources
   أظهر الإجابة

   الإجابة: B. Microsoft's cloud identity and access management service

   Microsoft Entra ID is Microsoft's cloud-based identity and access management service for signing in to cloud apps.

2. السؤال 2 من 15

   In multifactor authentication, which type of factor is a fingerprint scan?

   • ASomething you are
   • BSomething you know
   • CSomething you have
   • DSomething you can see
   أظهر الإجابة

   الإجابة: A. Something you are

   MFA factors are something you know (a password), something you have (a code on your phone) and something you are (a fingerprint or face scan).

3. السؤال 3 من 15

   What does single sign-on (SSO) let a user do?

   • AShare one account with the whole team
   • BSign in once and then use several trusted apps
   • CSkip signing in on every company device
   • DUse one password that never has to change
   أظهر الإجابة

   الإجابة: B. Sign in once and then use several trusted apps

   SSO lets a user sign in once and access multiple trusted applications. It is only as secure as that first sign-in.

4. السؤال 4 من 15

   A worker has their own Windows PC and wants to sign in with a face scan or PIN tied to that PC instead of a password. Which option fits?

   • AA FIDO2 security key
   • BAzure Key Vault
   • CWindows Hello for Business
   • DMicrosoft Entra Domain Services
   أظهر الإجابة

   الإجابة: C. Windows Hello for Business

   Windows Hello for Business suits workers with their own Windows PC. Its biometric and PIN credentials are tied to that PC. A FIDO2 key is a separate hardware device.

5. السؤال 5 من 15

   An older app needs domain join, group policy and Kerberos sign-in, but the company doesn't want to run domain controllers. Which service fits?

   • AMicrosoft Entra Domain Services
   • BMicrosoft Entra Conditional Access
   • CAzure DNS
   • DMicrosoft Purview
   أظهر الإجابة

   الإجابة: A. Microsoft Entra Domain Services

   Microsoft Entra Domain Services provides managed domain join, group policy, LDAP and Kerberos/NTLM authentication without deploying or maintaining domain controllers.

6. السؤال 6 من 15

   A supplier's staff sign in to your company's apps with their own work accounts and appear in your directory as guest users. What is this?

   • AMicrosoft Entra External ID for customers
   • BMicrosoft Entra Domain Services
   • CAzure role-based access control
   • DB2B collaboration
   أظهر الإجابة

   الإجابة: D. B2B collaboration

   With B2B collaboration, external users sign in with their own identities and are usually represented in your directory as guest users.

7. السؤال 7 من 15

   A company is building a shopping app and wants its customers to sign up and sign in. Which offering is designed for this?

   • AEntra External ID for customers
   • BB2B direct connect
   • CMicrosoft Entra Domain Services
   • DAzure role-based access control
   أظهر الإجابة

   الإجابة: A. Entra External ID for customers

   Microsoft Entra External ID for customers (formerly Azure AD B2C) handles identity for apps that you publish to consumers and customers.

8. السؤال 8 من 15

   Which pair shows a Conditional Access signal and a decision?

   • ASignal: sign-in from an unusual location; decision: require MFA
   • BSignal: a storage tier; decision: move data to archive
   • CSignal: a monthly budget limit; decision: email the invoice early
   • DSignal: a VM size; decision: add more RAM
   أظهر الإجابة

   الإجابة: A. Signal: sign-in from an unusual location; decision: require MFA

   Conditional Access uses signals such as user, location, device and app to decide whether to allow access, require MFA or block, and then enforces the decision.

9. السؤال 9 من 15

   What does the principle of least privilege mean?

   • AGive people only the access needed for their task
   • BRemove all access outside office hours
   • CGive access only to the most senior staff
   • DGive every user Owner access to save time
   أظهر الإجابة

   الإجابة: A. Give people only the access needed for their task

   The principle of least privilege says you should only grant access up to the level needed to complete a task.

10. السؤال 10 من 15

    You assign a group the Reader role at the subscription scope. What can the group's members do?

    • AChange any resource in the subscription
    • BView every resource group and resource in it
    • CView resources in every subscription in the tenant
    • DView only the subscription's billing account
    أظهر الإجابة

    الإجابة: B. View every resource group and resource in it

    Azure RBAC is hierarchical: access granted at a parent scope is inherited by all child scopes, so Reader at a subscription lets members view everything in it.

11. السؤال 11 من 15

    One role assignment gives you read access to a resource group, and another gives you write access to the same group. What access do you have?

    • AWrite only, because the newer role replaces the older one
    • BBoth read and write
    • CRead only, because the more limited role always wins
    • DNo access, because the two roles conflict
    أظهر الإجابة

    الإجابة: B. Both read and write

    Azure RBAC uses an allow model, so the permissions from your role assignments add together.

12. السؤال 12 من 15

    Azure RBAC is enforced on actions that pass through which Azure service?

    • AAzure DNS
    • BApplication Insights
    • CAzure Resource Manager
    • DAzure Data Box
    أظهر الإجابة

    الإجابة: C. Azure Resource Manager

    Azure RBAC is enforced on any action against an Azure resource that passes through Azure Resource Manager. It doesn't control access inside your application or data.

13. السؤال 13 من 15

    Which is one of the three guiding principles of Zero Trust?

    • AGive everyone the Owner role
    • BCheck each user's identity only once a year
    • CAssume breach
    • DTrust every device on the internal network
    أظهر الإجابة

    الإجابة: C. Assume breach

    Zero Trust is based on three principles: verify explicitly, use least privilege access, and assume breach.

14. السؤال 14 من 15

    In the defence-in-depth model, which layer is the innermost?

    • AData
    • BPerimeter
    • CPhysical security
    • DNetwork
    أظهر الإجابة

    الإجابة: A. Data

    The layers go from physical security on the outside through identity, perimeter, network, compute and application to data on the inside.

15. السؤال 15 من 15

    What is the purpose of Microsoft Defender for Cloud?

    • AEstimating the monthly cost of new resources
    • BHosting DNS domains on Azure's name servers
    • CSyncing files between a Windows server and Azure Files
    • DSecurity posture management and threat protection
    أظهر الإجابة

    الإجابة: D. Security posture management and threat protection

    Defender for Cloud is a security posture management and threat protection service for cloud, on-premises, hybrid and multicloud resources, with recommendations, a secure score and alerts.

لوحة المفاتيح: 1–4 للإجابة، وEnter للسؤال التالي.

الاختبار الحقيقي: 700 or greater (scale of 1 to 1,000)