AZ-305 Question 53
Select 2Fabrikam, Inc. has several Azure subscriptions and is concerned about managing elevated privileges and ensuring users only have access to the resources they actually need. The security team also wants to regularly review and certify access for both regular and privileged accounts to meet compliance standards. Which two Azure Active Directory (Azure AD) features or services should you recommend to address these requirements?
- A
A. Azure AD Access Reviews
- B
B. Azure AD Privileged Identity Management (PIM)
- C
C. Azure AD Connect Health
- D
D. Azure AD Password Protection
- E
E. Azure AD B2C
Show answer and explanation
Correct answers: A, B
Explanation
Azure AD Access Reviews and Privileged Identity Management (PIM) form the core of Microsoft’s identity governance solution. Access Reviews allow periodic reevaluation of user access rights, while PIM enables just-in-time access for privileged roles. These two services together address Fabrikam’s requirements for controlling elevated privileges and ensuring regular certification of user access. For further details, refer to Microsoft documentation on Identity Governance in Azure Active Directory (https://learn.microsoft.com/azure/active-directory/governance/).
- A. Correct.
A. Azure AD Access Reviews: Correct. Access Reviews help organizations regularly evaluate and certify user access to resources. They allow reviewers to confirm whether users should retain access or revoke it if no longer necessary, directly addressing compliance needs.
- B. Correct.
B. Azure AD Privileged Identity Management (PIM): Correct. PIM enforces just-in-time and time-bound access for privileged roles. It also provides oversight into changes in role assignments and can require approval processes, thereby reducing the risk associated with permanent administrative privileges.
- C. Incorrect.
C. Azure AD Connect Health: Incorrect. Azure AD Connect Health monitors the health of on-premises identity infrastructure and synchronizations. While it’s useful for operational insights, it doesn’t directly address the governance and review of user privileges.
- D. Incorrect.
D. Azure AD Password Protection: Incorrect. Azure AD Password Protection is a feature designed to prevent weak passwords. It doesn’t provide any capabilities for reviewing or limiting access to Azure resources.
- E. Incorrect.
E. Azure AD B2C: Incorrect. Azure AD B2C is used mainly for consumer-facing identity management scenarios. It does not offer the governance features needed for reviewing internal user access or managing privileged identities.