Task 2.4: Describe Azure identity, access, and security

• AMicrosoft Entra External ID

  Incorrect

  External ID doesn't provide domain join, Group Policy or Kerberos for VMs.

• BMicrosoft Entra Connect

  Incorrect

  Entra Connect doesn't host a domain for VMs to join, so the company would still need its own domain controllers.

• CMicrosoft Entra ID with single sign-on

  Incorrect

  Microsoft Entra ID uses modern authentication protocols. It doesn't offer domain join with Group Policy or Kerberos for legacy apps.

• DMicrosoft Entra Domain Services

  Correct

  Domain Services provides managed domain join, Group Policy, LDAP and Kerberos or NTLM authentication without you running domain controllers.

Microsoft Entra Domain Services gives a managed domain for legacy applications that can't use modern authentication. Azure deploys and maintains the domain controllers, and users sign in with their existing Microsoft Entra credentials.

• AApproving a sign-in notification in an authenticator app on their phone

  Correct

  The phone is something the user has, a different category from a password.

• BAnswering a security question set up during registration

  Incorrect

  A security question is something the user knows, the same category as the password.

• CEntering a second, separate password

  Incorrect

  A second password is still something the user knows, so the sign-in stays single-factor.

• DSigning in from a trusted office IP address

  Incorrect

  Where a sign-in comes from is information about the request, not a credential the user presents, so it adds no authentication factor.

• EScanning a fingerprint on a reader

  Correct

  A fingerprint is something the user is, a biometric factor.

Multifactor authentication combines factors from different categories: something you know, such as a password or a security question; something you have, such as a phone; and something you are, such as a fingerprint or face scan. Two factors from the same category don't make sign-in multifactor.

• AConditional Access

  Correct

  Conditional Access evaluates signals such as location during sign-in and can allow access or require MFA based on them.

• BAzure role-based access control

  Incorrect

  Azure RBAC assigns roles; it doesn't change sign-in requirements by location.

• CSelf-service password reset

  Incorrect

  Self-service password reset lets users reset their own passwords; it doesn't add sign-in conditions.

• DMicrosoft Entra Domain Services

  Incorrect

  Domain Services doesn't evaluate where a sign-in comes from or decide when to ask for MFA.

Conditional Access collects signals at sign-in, such as who the user is, where they are and which device they use, decides, and enforces the decision: allow, block or require MFA. Requiring MFA for people outside trusted network locations is one of its standard uses.

• ACreate and change resources, because Azure RBAC adds the permissions together

  Correct

  Azure RBAC is an allow model: when one assignment grants read and another grants write on the same scope, the user has both.

• BView resources but not change them, because the more restrictive role wins

  Incorrect

  Azure RBAC doesn't pick the most restrictive role; role assignments add up.

• CNothing until one assignment is removed, because conflicting roles block access

  Incorrect

  Overlapping assignments don't conflict in Azure RBAC; each simply adds its permissions.

• DView resources, because a direct assignment overrides a group assignment

  Incorrect

  Direct and group assignments carry equal weight. Group assignments apply to members just as direct ones do.

Azure RBAC uses an allow model. If one role assignment grants read permissions on a resource group and another grants write permissions on the same resource group, the user has read and write permissions there.

• AUse least privilege access

  Incorrect

  Least privilege limits how much access each identity gets, rather than how each request is checked.

• BAssume breach

  Incorrect

  Assume breach limits the impact of an attack through segmentation, encryption and analytics.

• CDefense in depth

  Incorrect

  Defense in depth is a separate model of layered protections around data, not one of the three Zero Trust principles.

• DVerify explicitly

  Correct

  Verify explicitly means always authenticating and authorizing based on all available data points.

Zero Trust has three guiding principles: verify explicitly, use least privilege access and assume breach. Checking every request against all available signals, instead of trusting the network it comes from, is verifying explicitly.

• AFix the open recommendations to harden its resources

  Incorrect

  Remediating recommendations improves the security posture, but it doesn't add threat detection or alerts for attacks under way.

• BAssign more built-in Azure Policy definitions to the servers

  Incorrect

  Policy definitions evaluate resource configurations against rules; they don't detect attacks on the servers.

• CEnable the Defender CSPM plan for advanced posture management

  Incorrect

  Defender CSPM adds posture tools such as attack path analysis. Security alerts come with the workload protection plans.

• DEnable the Defender for Servers workload protection plan

  Correct

  Defender for Servers is a workload protection plan that provides threat detection and advanced defenses for Windows and Linux machines, including security alerts.

Defender for Cloud includes free foundational posture management, such as security recommendations and the Microsoft cloud security benchmark. Threat protection is added per workload with Defender plans such as Defender for Servers or Defender for Storage, and security alerts come from those workload protection plans.

• ALater app connections rely on that first authentication

  Correct

  SSO is only as secure as the initial authenticator, because the following connections depend on it, so it deserves strong protection such as MFA.

• BSSO stores a separate password for each app that an attacker could read

  Incorrect

  SSO reduces the number of passwords. Users don't keep a separate one for each app.

• CSSO makes each app ask for its own multifactor prompt

  Incorrect

  With SSO, later connections rely on the first sign-in rather than prompting again in each app.

• DSSO turns off Conditional Access for the connected apps

  Incorrect

  Conditional Access is a separate Microsoft Entra ID tool that evaluates sign-in signals; SSO doesn't turn it off.

Single sign-on lets a user sign in once and reach many trusted apps, reducing password sprawl and simplifying access changes. Its security rests on the initial sign-in, so that authentication should be strong.

• AThe perimeter layer

  Correct

  The perimeter layer uses DDoS protection and perimeter firewalls against network-based attacks on your resources.

• BThe network layer

  Incorrect

  The network layer limits communication between resources through segmentation and access controls.

• CThe compute layer

  Incorrect

  The compute layer secures access to virtual machines and keeps systems patched.

• DThe identity and access layer

  Incorrect

  The identity and access layer controls who can reach infrastructure and audits sign-ins and changes.

Defense in depth places data at the center, surrounded by layers: physical security, identity and access, perimeter, network, compute, application and data. The perimeter layer filters large-scale attacks with DDoS protection and uses perimeter firewalls to alert on malicious traffic.

• AThe compliance view in Azure Policy

  Incorrect

  Policy compliance shows which resources meet the rules you assigned; it doesn't produce a security posture score.

• BThe cost category in Azure Advisor

  Incorrect

  Advisor's cost category recommends savings, not security posture improvements.

• CThe secure score in Microsoft Defender for Cloud

  Correct

  Defender for Cloud groups its recommendations into security controls and calculates a secure score so teams can prioritize improvements.

• DResource Health in Azure Service Health

  Incorrect

  Resource Health reports whether a resource is running normally, not how secure it is.

Microsoft Defender for Cloud continuously assesses resources against the Microsoft cloud security benchmark, surfaces prioritized recommendations and rolls them up into a secure score that shows the current security posture at a glance.