AZ-305 Design infrastructure solutions Practice Question
A company needs to provide secure access to Azure resources for remote employees. They want to enforce multi-factor authentication and conditional access policies. The solution should not require a VPN connection. Which Azure service should they implement?
⚠ Common exam trap
Many exam-takers confuse network-level security services (like VPN Gateway or Bastion) with identity-level security services (like Entra ID), mistakenly thinking a VPN is required to enforce MFA or conditional access, when in fact Entra ID handles these controls at the authentication layer without any network tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID
Microsoft Entra ID (formerly Azure Active Directory) provides identity and access management services that include multi-factor authentication (MFA) and conditional access policies. These capabilities allow you to enforce security requirements like MFA and device compliance before granting access to Azure resources, all without requiring a VPN connection. Entra ID acts as the identity provider and policy engine, making it the correct choice for this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based enterprise mobility management (EMM) and mobile device management (MDM) service. It manages device enrollment, configuration, compliance, and application protection, but it does not authenticate users or directly grant access to Azure resources. While Intune device compliance can be used as a signal in Conditional Access, the actual access decision is made by Microsoft Entra ID, not Intune.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway creates encrypted IPsec/IKE tunnels, enabling site-to-site or point-to-site network connectivity between on-premises environments and Azure Virtual Networks. It only establishes network-level connectivity; it provides no identity authentication, authorization, or Conditional Access capabilities for accessing Azure services. Users still must authenticate through Entra ID to obtain tokens for Azure resources after a VPN session is established.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully platform-managed PaaS service that provides secure, seamless RDP and SSH connectivity to virtual machines directly through the Azure portal over TLS. It eliminates public IP addresses on VMs and protects against port-level attacks, but its scope is limited to administrative VM management sessions. Bastion does not control access to Azure resources generally (such as storage, databases, or the Azure Resource Manager control plane) and cannot replace identity-based access policies.
- ✓
Microsoft Entra ID
Why this is correct
Microsoft Entra ID is the foundational identity and access management (IAM) service for Azure and acts as the central authentication and authorization control plane. It authenticates users, issues access tokens via OAuth 2.0 and OpenID Connect, and enforces Conditional Access policies, including MFA, device compliance, and risk detection. All Azure Resource Manager and data-plane access ultimately depends on Entra ID tokens, making it the correct identity-based solution for secure access to Azure resources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.