Microsoft Entra ID & Identity

What is Microsoft Entra ID?

• AA cloud-based virtual machine hosting service
• BA relational database service for storing application data
• CA content delivery network for speeding up websites
• DA cloud-based identity and access management service✓

Answer: Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity and access management service, providing authentication, authorization and directory features. It is not a compute, database or content-delivery service.

Which of these is an example of a hybrid identity scenario?

• AAccounts are created in Microsoft Entra ID with no on-premises directory in use
• BAccounts are kept in on-premises Active Directory with no connection to the cloud
• COn-premises Active Directory accounts are synchronized to Microsoft Entra ID✓
• DEach application keeps its own separate set of local accounts and passwords

Answer: Hybrid identity connects an on-premises directory to Microsoft Entra ID, commonly by synchronizing accounts so users have one identity across both. Cloud-only or on-premises-only setups are not hybrid.

What is the purpose of multifactor authentication (MFA)?

• ATo let a single user sign in to several different applications using just one shared password everywhere
• BTo store the user's password securely in an encrypted vault for reuse
• CTo automatically reset each user's account password every few weeks according to a fixed company policy
• DTo require two or more different types of verification to prove identity✓

Answer: MFA requires at least two factors from different categories, such as something you know, something you have and something you are, making stolen passwords far less useful. Single sign-on, password storage and forced resets are different features.

What does Microsoft Entra Conditional Access do?

• AIt applies access policies based on signals such as user, device, location and risk✓
• BIt encrypts the files stored in the organization's cloud storage accounts
• CIt creates a backup copy of each user's mailbox, on a fixed daily schedule
• DIt scans email attachments for viruses before they are delivered

Answer: Conditional Access evaluates signals like user, device state, location, application and risk, then enforces controls such as requiring MFA or blocking access. It is not an encryption, backup or antivirus feature.

What is the main purpose of Microsoft Entra Privileged Identity Management (PIM)?

• ATo give administrators permanent, standing access to privileged roles
• BTo provide just-in-time, time-bound access to privileged roles✓
• CTo store the organization's privileged passwords in a shared document
• DTo block administrators from signing in outside of office hours

Answer: PIM manages, controls and monitors privileged access by making roles eligible and activated just-in-time for a limited period, often with approval and MFA. It reduces standing privilege rather than granting permanent admin access.

What do Microsoft Entra access reviews help an organization to do?

• AAutomatically grant new access to users who request it through a form
• BEncrypt the directory so that access assignments cannot be read by attackers
• CPeriodically recertify that users still need the access they have been granted✓
• DAssign roles and permissions to new users automatically when they join

Answer: Access reviews let reviewers periodically confirm whether users still require their group memberships, roles or app access, removing access that is no longer needed. They govern existing access rather than granting or encrypting it.

What does Microsoft Entra ID Protection use to detect risky sign-ins and users?

• AA manual review of sign-in logs carried out by an administrator each day
• BA fixed list of blocked countries that administrators maintain by hand
• CThe physical location of the server hosting the application being accessed
• DRisk detections and signals analyzed to flag suspicious identity activity✓

Answer: Identity Protection uses risk detections and signals to identify risky sign-ins and users, which can feed risk-based Conditional Access policies. It is automated rather than a manual daily review, and is not a fixed country list.

Which built-in capability lets you assign users only the permissions they need through roles?

• AAssigning the Global Administrator role to users for simplicity
• BSharing one administrator account among the whole IT team
• CRole-based access control (RBAC) with Microsoft Entra roles✓
• DAssigning permissions directly to individual user accounts by hand

Answer: RBAC assigns permissions through roles scoped to what a user needs, supporting least privilege. Handing out Global Administrator or sharing an account undermines least-privilege access, and assigning permissions user by user is not role-based.

What is a benefit of single sign-on (SSO) in Microsoft Entra ID?

• AUsers are required to enter a different password for each application they open during the working day
• BUsers sign in once and gain access to multiple connected applications✓
• CEach application stores its own copy of the user's password locally
• DAdministrators lose the ability to control which applications each individual user is allowed to access

Answer: SSO lets a user authenticate once and then access multiple applications without signing in again, improving experience and reducing password fatigue while keeping central control. It is the opposite of separate per-app passwords.

Which passwordless method uses public-key cryptography and is phishing-resistant?

• AA FIDO2 security key✓
• BA one-time passcode sent by SMS text message
• CA memorable security question set during sign-up
• DA password that is changed on a regular schedule

Answer: A FIDO2 security key authenticates with public-key cryptography bound to the site, so there is no password to phish or replay. SMS codes, security questions and rotating passwords are not phishing-resistant passwordless methods.

What does Microsoft Entra ID Governance help organizations manage?

• AThe physical wiring and cabling of the on-premises data center
• BThe pricing and billing of the organization's Azure subscriptions
• CThe identity lifecycle and access, including entitlements and access reviews✓
• DThe performance tuning of queries, and indexes, on the SQL databases each day

Answer: Entra ID Governance provides capabilities such as entitlement management, access reviews and lifecycle workflows to ensure the right people have the right access for the right time. It is not a facilities, billing or database-tuning tool.