Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
How Entra ID Protection Enforces Risk-Based Access
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is adopting a Zero Trust security model across its cloud infrastructure to protect corporate resources. The security team needs a solution that continuously detects identity-related risks, flags suspicious sign-in activities, and automatically enforces risk-based policies to respond to detected threats.
Which identity feature should the enterprise implement?
Explanations
Customer Lockbox for Microsoft Azure
Customer Lockbox for Microsoft Azure
What Customer Lockbox Is
Customer Lockbox for Microsoft Azure is a security and governance feature that provides customers with explicit control over data access when Microsoft support engineers require elevated permissions to resolve a support incident.
Why It Doesn't Meet the Requirement
- Different Operational Purpose: Customer Lockbox focuses on human support workflow approvals rather than identity risk detection or automated threat remediation.
- No Sign-In Risk Assessment: It does not evaluate user sign-in anomalies, compromised credentials, or dynamic session risk.
- No Automated Policy Triggers: It cannot automatically enforce Multi-Factor Authentication or block risky access attempts based on user behavior.
Key Characteristics and Limitations
- Support Access Control: Gives administrators an interface to review, approve, or deny explicit access requests from Microsoft engineers.
- Time-Bound Permissions: Grants limited, just-in-time access only after explicit customer approval.
- Audit Logging: Records all approval and rejection actions for compliance and tracking.
This Answer Would Be Correct If
The organization needed to ensure that Microsoft support personnel could not access customer data during troubleshooting without explicit, auditable administrative approval from within the Azure portal.
Azure Blueprints
Azure Blueprints
What Azure Blueprints Is
Azure Blueprints is a governance service that enables cloud architects to define and deploy a repeatable set of Azure resources, resource groups, role assignments, and policy assignments to maintain organizational compliance across cloud subscriptions.
Why It Doesn't Meet the Requirement
- Infrastructure Orchestration Focus: Azure Blueprints automates environment provisioning and resource governance, not identity threat detection.
- Lacks Real-Time Threat Analysis: It does not monitor active user sessions, sign-in locations, or compromised credentials.
- No Risk-Based Identity Response: It cannot enforce real-time authentication policies dynamically when a user's account risk level changes.
Key Characteristics and Limitations
- Declarative Deployment: Bundles Azure Resource Manager (ARM) templates, Azure Policy definitions, and role-based access control (RBAC) assignments.
- Environment Standardization: Ensures new subscriptions adhere to enterprise standards and patterns.
- Lifecycle Management: Tracks and updates blueprint definitions across multiple environments and subscriptions.
This Answer Would Be Correct If
The scenario asked how to deploy standardized, compliant cloud environments consisting of predefined resource groups, policy definitions, and role assignments in a repeatable, automated manner.
Microsoft Entra ID Protection
Microsoft Entra ID Protection
What Microsoft Entra ID Protection Is
Microsoft Entra ID Protection is an identity security tool that allows organizations to detect, investigate, and remediate identity-based risks. It provides automated detection of suspicious events—such as unfamiliar sign-in properties, atypical travel, and compromised credentials—and assigns real-time risk levels to users and sign-in sessions.
How It Meets the Zero Trust Requirements
- Continuous Risk Detection: Actively monitors identity signals across sign-in attempts and flags emerging risks on a central dashboard.
- Automated Policy Enforcement: Allows administrators to configure risk-based access policies that automatically require Multi-Factor Authentication (MFA), trigger password resets, or block access when a specified risk threshold (low, medium, or high) is reached.
- Zero Trust Alignment: Directly implements the core Zero Trust principle of Verify Explicitly by evaluating dynamic risk signals before granting access.
Key Advantages and Capabilities
- Automated Threat Remediation: Mitigates compromised accounts without requiring immediate manual intervention by security teams.
- Risk-Based Conditional Access: Integrates directly with Conditional Access to provide contextual security policies.
- Email Summaries and Dashboards: Provides security administrators with daily notifications and comprehensive reporting for incident response.
- Heuristic and Machine Learning Signals: Leverages vast threat intelligence to identify anomalous user behavior.
Why This Is Optimal
Microsoft Entra ID Protection is specifically built to defend the identity layer by assessing risk and automating responses, making it the most direct and effective mechanism for enforcing identity security policies within a Zero Trust architecture.
Azure Backup
Azure Backup
What Azure Backup Is
Azure Backup is a cloud-based backup and disaster recovery service that protects corporate data by securely creating recovery points and restoring data across on-premises servers, virtual machines, and cloud databases.
Why It Doesn't Meet the Requirement
- Data Protection Focus: Azure Backup is designed for data availability and business continuity rather than identity and access management.
- No Identity Evaluation: It does not analyze authentication requests, user risk, or suspicious network locations.
- No Dynamic Access Enforcement: It lacks the ability to trigger security challenges like Multi-Factor Authentication during sign-ins.
Key Characteristics and Limitations
- Centralized Vault Management: Stores backup copies in secure Azure Recovery Services vaults.
- Automated Scheduling: Executes scheduled backups of virtual machines, files, and databases without manual intervention.
- Ransomware Resiliency: Protects against accidental deletion and malicious data corruption with retention controls.
This Answer Would Be Correct If
The company required a centralized service to protect critical virtual machines and storage accounts from data loss by providing automated snapshot schedules and granular data restoration.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zero Trust Least Privilege Just-In-Time Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Managed Identities
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zero Trust Least Privilege Access
Describe the concept of Zero Trust
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense-in-Depth Perimeter Layer
Describe the purpose of the defense-in-depth model
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated