AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides a flexible, highly available LDAP (Lightweight Directory Access Protocol) and Kerberos service without managing domain controllers?
⚠ Common exam trap
Candidates often confuse Azure AD (a cloud identity provider) with Azure AD DS (a managed domain service), assuming Azure AD natively supports LDAP and Kerberos, when in fact it does not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure AD Domain Services
Azure AD Domain Services (Azure AD DS) provides managed domain services such as LDAP and Kerberos authentication without the need to deploy, patch, or maintain domain controllers. It automatically synchronizes identities from Azure AD or an on-premises Active Directory, offering a fully managed, highly available service that supports legacy directory-aware applications and lift-and-shift scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Active Directory (Azure AD)
Why it's wrong here
Azure AD is a cloud identity and access management service for Microsoft 365 and Azure, authenticating users through OAuth 2.0, OpenID Connect, and SAML, and providing features like conditional access and MFA. It does not expose a Lightweight Directory Access Protocol (LDAP) endpoint, does not support Kerberos/NTLM authentication, and cannot join virtual machines to a traditional domain, so it cannot provide the managed domain services described in the scenario.
- ✓
Azure AD Domain Services
Why this is correct
Azure AD Domain Services is the correct answer because it provides a Microsoft-managed domain in Azure, exposing LDAP, Kerberos, NTLM, Group Policy, and domain-join capabilities without the operational burden of deploying and patching your own domain controllers. It synchronizes identity objects one-way from Azure AD, and through Azure AD Connect it can also receive on-premises Active Directory identities, which enables existing applications that use legacy authentication protocols to be lifted and shifted into Azure while retaining their directory service dependencies.
- ✗
Azure AD B2C
Why it's wrong here
Azure AD B2C is an identity service designed for external consumer-facing applications, allowing users to sign in using social identities, local accounts, or federation providers through customizable browser-based authentication flows. It is not an enterprise directory and does not provide LDAP, Kerberos, NTLM, or Group Policy support, nor can it domain-join Azure VMs. Its purpose—customer identity and access management—is fundamentally different from offering managed domain services for legacy applications.
- ✗
Azure Active Directory Connect
Why it's wrong here
Azure AD Connect is a synchronization utility, not a directory service. It runs on an on-premises server and copies user objects, password hashes, and group memberships from an on-premises Active Directory forest into Azure AD, enabling hybrid single sign-on. Because it is only a sync tool and does not operate domain controllers, it provides no LDAP, Kerberos, Group Policy, or domain-join capabilities for Azure workloads, making it incapable of delivering managed domain services.
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.