AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure AD Domain Services

  Why it's wrong here

  Azure AD Domain Services delivers managed domain infrastructure, including LDAP, Kerberos, and NTLM authentication, Group Policy, and domain join, which supports legacy Windows workloads that cannot use modern cloud APIs. Although it authenticates domain-joined resources, it is not the cloud identity provider for SSO, MFA, or conditional access across Microsoft services and SaaS apps. It exists to simplify lift-and-shift domain-joined workloads, not to act as the company-wide identity and access management stack, so it does not answer the question.

• ✓

  Azure Active Directory (Azure AD)

  Why this is correct

  Azure Active Directory (now Microsoft Entra ID) is Microsoft's cloud-native identity and access management service that provides authentication as a service, including single sign-on, multi-factor authentication, conditional access, device registration, and identity governance for both cloud and hybrid environments. It acts as the central identity provider for Office 365, Azure, and thousands of SaaS applications, and can federate with on-premises Active Directory using Azure AD Connect. Its core function is verifying users and controlling access to resources, making it the correct choice.

• ✗

  Azure Key Vault

  Why it's wrong here

  Azure Key Vault is a secure store for cryptographic keys, secrets, and certificates, designed to protect sensitive configuration data such as passwords, connection strings, and TLS keys used by applications. It provides encryption operations through HSM-backed keys and enforces access policies for service principals, but it does not authenticate interactive users or manage identity lifecycle. Since the scenario calls for identity, SSO, and MFA capabilities, Key Vault is not the applicable service and is therefore incorrect.

• ✗

  Azure Information Protection

  Why it's wrong here

  Azure Information Protection is a data classification and labeling service, now integrated into Microsoft Purview, that applies persistent labels, encryption, and usage policies to documents and emails to protect sensitive information. It does not perform identity authentication or issue access tokens, nor does it provide SSO or MFA; its encryption-only restrictions govern how content can be used after it is opened. Because the question specifically targets identity and authentication scenarios, this option is incorrect.