Question 610 A team expects Microsoft Entra Domain Services to be the primary cloud identity directory that directly replaces all Entra tenant management. What distinction should it understand? Domain Services is an Azure Blob tier Managed domain services grant unrestricted global administrator automatically An Azure virtual network is a user directory Entra Domain Services is a managed domain offering linked to Entra ID identities, not the primary Entra cloud directory Explanation Correct Answer D:The services address different identity protocols and administration models. Incorrect Answers A:It is an identity service, not storage. B:No default cloud-wide admin grant follows. C:Networking cannot replace cloud identity.
Question 611 An organization wants full domain-controller OS access to install custom AD DS extensions. Is Microsoft Entra Domain Services a drop-in equivalent to self-managed controllers? Yes, it always allows every custom forest extension Yes, every managed DC is a tenant-administered VM No, because Entra Domain Services cannot authenticate users at all No, managed Domain Services abstracts the underlying domain-controller hosts Explanation Correct Answer D:Organizations needing unrestricted DC host control may require separately managed domain controllers. Incorrect Answers A:Managed scope has supported boundaries. B:The domain-controller infrastructure is managed by the service. C:It supports managed domain authentication mechanisms.
Question 612 A contractor has access to one SaaS app but not to Azure subscriptions. Which control should govern that application's access? Modify Blob redundancy for the tenant Grant subscription Owner to make the SaaS app work App-specific assignment and guest identity access reviews Publish a shared app password to all guests Explanation Correct Answer C:External sign-in and Azure resource management roles are different scopes. Incorrect Answers A:Storage placement doesn't manage guest SaaS access. B:An unrelated management role is excessive. D:Shared secrets undermine accountability.
Question 613 A company wants group membership to follow supported user attributes rather than manual updates. Which directory capability may help? Blob lifecycle policies Dynamic group membership rules where available Use a static application display name as though it continuously evaluates group membership rules VM scale-set autoscaling Explanation Correct Answer B:Rules can maintain group membership according to approved identity attributes. Incorrect Answers A:Object aging isn't group membership. C:Dynamic group membership requires supported attribute-based rule evaluation, not names alone. D:Compute autoscale doesn't manage Entra users.
Question 614 A custom application needs a dedicated identity for obtaining delegated or application permissions to protected APIs. What object family is relevant? An Azure VM availability set Use an Azure resource-group tag as the application's service identity An Azure Files share Microsoft Entra application registration and corresponding service principal Explanation Correct Answer D:App identities can authenticate and be granted appropriately scoped API permissions. Incorrect Answers A:Compute placement is not an API client identity. B:Tags are metadata; an Entra application registration represents an application identity and configuration. C:A file share doesn't provide OAuth client registration.
Question 615 An Azure-hosted service needs tokens for Azure resources without a password stored in code. Which identity approach is designed for this? Hardcode the same account key in every deployment script Use a VM's display name as an access token Managed identity for Azure resources Allow public anonymous access to all resources Explanation Correct Answer C:Managed identity gives supported workloads an automatically managed service identity. Incorrect Answers A:Embedded secrets increase exposure and maintenance. B:Resource names are not bearer credentials. D:Anonymous data access defeats protected authentication.
Question 616 An auditor needs to inspect Azure VM configuration but must not start, stop or delete the VM. Which Azure RBAC role is a starting point? User Access Administrator Reader at the narrowest appropriate scope Contributor on the resource group Owner on the subscription Explanation Correct Answer B:Reader grants visibility without general management write rights. Incorrect Answers A:This focuses on managing access assignments, not simple viewing. C:Contributor can modify many resources beyond read-only needs. D:Owner permits broad management and access delegation.
Question 617 An engineer must deploy and configure ordinary Azure resources in one approved resource group but should not delegate access to others. Which built-in role may fit? Contributor scoped to that resource group Reader Owner on the tenant root scope Billing Reader only Explanation Correct Answer A:Contributor supports general resource management without broad role-assignment powers. Incorrect Answers B:Reader cannot deploy or update resources. C:Owner is broader than required and can delegate access. D:Billing visibility is not resource deployment permission.
Question 618 A team member must manage Azure resources and assign access to other staff for one subscription. Which built-in role includes these abilities? Owner on the intended subscription Storage Blob Data Reader Reader Contributor alone Explanation Correct Answer A:Owner combines broad management actions with access administration at scope. Incorrect Answers B:A data-plane reader role isn't subscription management authority. C:Reader cannot manage resources or grant roles. D:Contributor generally cannot create role assignments by default.
Question 619 A group is assigned Reader at a subscription, and its users can view resources inside child resource groups. What explains this? Assign a role at one VM and assume it automatically applies to every other subscription A storage access tier creates subscription-wide roles Azure RBAC assignments apply at their scope and inherit to children A VM image automatically duplicates role assignments Explanation Correct Answer C:Subscription-level Reader typically includes descendant resources. Incorrect Answers A:RBAC scope inheritance follows the ARM hierarchy; unrelated subscriptions are not descendants of a VM. B:Object temperature isn't RBAC. D:Images don't decide authorization scope.
Question 620 A vendor only needs to operate one Azure VM in a shared subscription. Which access approach best supports least privilege? Assign the necessary role at the narrowest resource scope supported Grant Owner at the root management group for convenience Move all other VMs to a different region to separate access Share the subscription administrator password Explanation Correct Answer A:A resource-scoped assignment avoids granting unnecessary access to peers. Incorrect Answers B:That greatly exceeds the single-VM requirement. C:Regional placement isn't an authorization replacement. D:Shared credentials reduce accountability and scope control.
