AZ-900 Describe Azure management and governance Practice Question
Which Azure governance concept ensures that access to resources is granted only to users who need it for their job function?
⚠ Common exam trap
Many exam-takers confuse 'defense in depth' (a layered security strategy) with 'principle of least privilege' (an access control concept), leading them to pick Option A when the question specifically asks about granting access based on job function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Principle of least privilege
The principle of least privilege is an Azure governance concept that ensures users are granted only the minimum permissions necessary to perform their job functions. In Azure, this is implemented through Azure RBAC (Role-Based Access Control), where custom or built-in roles define specific actions allowed on resources, preventing over-permissioning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security architecture that employs multiple compensating layers of protection, such as network security groups, firewalls, encryption, and monitoring, so that a failure in one layer does not expose the resource. It assumes that any single layer can be breached and therefore uses overlapping controls to slow an attacker. Least privilege is instead an authorization concept that specifically limits identity permissions; it is not about adding protective layers.
- ✓
Principle of least privilege
Why this is correct
The principle of least privilege restricts user, application, or service principal access to only the minimum permissions required to perform assigned job functions. By granting granular permissions at the appropriate scope, Azure reduces the attack surface and limits the potential blast radius if a credential is compromised. This principle directly governs how RBAC role assignments are sized, ensuring no identity receives standing access beyond its operational need.
- ✗
Role inheritance
Why it's wrong here
Role inheritance describes how an RBAC role assignment made at a higher scope, such as a management group or subscription, is automatically inherited by all child resources and resource groups. It is a mechanism for propagating access, not a guideline for how much access should be granted. Understanding inheritance helps administrators audit effective permissions, but it does not determine the principle of granting only the minimum required access.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is a security control that divides critical tasks, such as requesting versus approving a change, across multiple individuals to prevent fraud and errors. This principle ensures no single person has end-to-end control over a high-risk process. While it can reduce insider threat, it is distinct from least privilege, which focuses on limiting the permissions themselves rather than splitting task ownership.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.