Security, identity & compliance
33 free practice questions with explanations
PassNova has 33 free Microsoft Azure Fundamentals (AZ-900) practice questions on Security, identity & compliance, each with a clear explanation. Practise them in the browser with instant feedback — 100% free, no sign-up, on any device. Updated for 2026.
Security, identity & compliance: example questions & answers
Here are 6 example questions from this topic. Practise the full set of 33 free in the browser.
-
What is Microsoft Entra ID (formerly Azure Active Directory)?
- A A relational database service
- B A cloud-based identity and access management service ✓
- C A virtual networking service
- D A storage redundancy option
Answer: Microsoft Entra ID is a cloud-based identity and access management service that handles sign-in and access to resources and applications.
-
What is the difference between authentication and authorization?
- A Authentication proves who you are; authorization determines what you can access ✓
- B Authentication grants access; authorization proves identity
- C They are identical concepts
- D Authorization always happens before authentication
Answer: Authentication (AuthN) verifies a user's identity, while authorization (AuthZ) determines what that authenticated identity is permitted to do.
-
What does Multi-Factor Authentication (MFA) require?
- A A single strong password
- B Two or more verification factors, such as a password plus a phone prompt ✓
- C A biometric scan only
- D Access from a corporate network only
Answer: MFA requires two or more independent verification factors, such as something you know, something you have, and something you are, increasing security.
-
What is the purpose of Azure Role-Based Access Control (RBAC)?
- A To encrypt data at rest
- B To assign fine-grained permissions to users, groups, and applications on resources ✓
- C To monitor network traffic
- D To distribute traffic across servers
Answer: Azure RBAC lets you grant the appropriate level of access to users, groups, and services by assigning roles scoped to resources, groups, or subscriptions.
-
Which security concept assumes no implicit trust and verifies every request as though it originates from an open network?
- A Defense in depth
- B Zero Trust ✓
- C Least privilege
- D Perimeter security
Answer: The Zero Trust model assumes breach and verifies each request explicitly, never trusting based on network location alone.
-
What is the 'defense in depth' security strategy?
- A Relying on a single strong firewall
- B Using multiple layers of security controls to protect data ✓
- C Encrypting only the most sensitive files
- D Granting all users administrative rights
Answer: Defense in depth uses a layered approach with multiple security controls so that if one layer fails, others still protect the data.