Describe Azure identity, access, and security
Objective identity.access-security sits in Describe Azure architecture and services, which carries 38% of the Azure Fundamentals exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A user is assigned the Contributor role at the subscription scope and separately assigned the Reader role on one resource group within that subscription. What is the user's effective permission level for that resource group?
The concept
Multiple grants at different levels do not compete, they combine. Effective access is the union of everything assigned at and above the resource, so the broadest grant is the one that decides what someone can do.
Why this answer
Since Contributor at the subscription scope already includes broader permissions than Reader, the sum of both assignments results in effective Contributor access on the resource group, making the Reader assignment have no additional impact.
- AAzure RBAC does not use an override model where narrower scope always wins; it sums permissions instead.
- Correct: RBAC is additive, so the broader Contributor permissions apply, and Reader adds nothing extra.
- CDeny assignments can block access, but two grant assignments never cancel each other out.
- DCombining Contributor and Reader does not produce Owner; Owner requires its own explicit role assignment.
Now you: objective identity.access-security questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A company is designing its network defenses and is considering relying on Conditional Access as its primary protection against denial-of-service (DoS) attacks. Based on how Conditional Access is intended to be used, why is this plan flawed?
Sample question 2 of 3
In Azure RBAC, at which four levels can a role be assigned to define the scope of access?
Sample question 3 of 3
An employee working from a home office needs to print to a corporate network printer without establishing a traditional VPN connection. A legacy finance application on the same corporate network still requires NTLM authentication and cannot be modified. Which pairing of Microsoft Entra services addresses both needs?
That’s 3 of the full Azure Fundamentals bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.