AZ-900 Describe Azure architecture and services Practice Question
What is Azure Active Directory (Azure AD)?
⚠ Common exam trap
Candidates often confuse Azure AD with on-premises Active Directory, assuming it is simply a cloud-hosted version of the same directory service, when in fact Azure AD is a fundamentally different identity platform focused on web-based authentication and authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A cloud-based identity and access management service
Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management (IAM) service. It provides authentication and authorization for users, applications, and resources in the cloud, supporting protocols like OAuth 2.0, OpenID Connect, and SAML. Unlike on-premises Active Directory, Azure AD is a multi-tenant, directory-as-a-service platform designed for cloud and hybrid scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A domain controller service for on-premises Active Directory
Why it's wrong here
Azure AD is not a domain controller service; it does not perform LDAP authentication or Kerberos ticket-based logins like on-premises Active Directory Domain Services. Instead of joining devices to a domain and enforcing group policies, Azure AD authenticates users to cloud and SaaS applications via REST APIs, OAuth 2.0, OpenID Connect, and SAML. It can integrate with on-prem AD via Azure AD Connect, but it remains a separate, cloud-native identity service.
- ✓
A cloud-based identity and access management service
Why this is correct
Azure AD (now Microsoft Entra ID) is Microsoft's cloud-based identity and access management (IAM) service. It provides identity directories for users and groups, single sign-on (SSO) for thousands of SaaS apps, multi-factor authentication, and token issuance based on OAuth 2.0, OpenID Connect, and SAML. It also enforces fine-grained authorization policies, like conditional access, to determine exactly what resources a signed-in user can access.
- ✗
A firewall service for protecting Azure resources
Why it's wrong here
Treating Azure AD as a firewall conflates network-layer security with identity-layer security. Azure Firewall inspects source/destination IP addresses, ports, and application rules to allow or deny traffic, while Azure AD enforces access decisions based on user identity, device health, and conditional access policies. Azure AD never inspects packets or blocks malicious IPs; it issues identity tokens and challenges users with MFA when risk is detected.
- ✗
A virtual private network for connecting to Azure
Why it's wrong here
Azure AD is an identity plane, not a network transport service. It never routes packets or establishes encrypted tunnels between your office and Azure—that is the role of Azure VPN Gateway. VPNs provide network-level connectivity, whereas Azure AD provides tokens and sign-in sessions that authorize access to APIs and applications. Even when VPN connectivity is used, Azure AD still governs who can authenticate and what they can access once on the network.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Identity and access management
Identity and access management (IAM) is the security discipline that ensures the right individuals access the right resources at the right times for the right reasons.
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.