AZ-900 Describe Azure management and governance Practice Question
Which feature allows Azure administrators to require users to complete an additional verification step (beyond password) before accessing Azure resources?
⚠ Common exam trap
Test-takers frequently confuse Azure AD MFA with Azure PIM, because PIM can require approval or activation for privileged roles, but it does not inherently enforce an additional authentication factor like MFA does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Active Directory Multi-Factor Authentication
Azure Active Directory Multi-Factor Authentication (MFA) is the correct feature because it specifically requires users to provide an additional form of verification (e.g., a phone call, text message, or app notification) beyond just a password before accessing Azure resources. This directly addresses the need for an extra security step, which is the core of MFA. Azure RBAC, Policy, and PIM do not enforce additional authentication factors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC (Role-Based Access Control) is an authorization mechanism that determines what operations a user can perform on Azure resources by assigning roles like Contributor or Reader. It does not inspect how the user proved their identity during sign-in; that is an authentication concern. RBAC only checks if the authenticated user has permission to perform a specific action, so it cannot enforce or require MFA during the sign-in process.
- ✓
Azure Active Directory Multi-Factor Authentication
Why this is correct
Azure Active Directory Multi-Factor Authentication (Azure AD MFA) is the security feature that explicitly requires a second verification form beyond the password, such as a mobile app approval, text message, or phone call. This protects against credential theft because the attacker must also possess or control the second factor. By implementing Azure AD MFA, organizations can block the vast majority of identity-based attacks, making it the correct answer for enforcing an additional authentication requirement.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance and compliance service that evaluates and enforces rules on Azure resources, such as required resource locations, tag usage, or SKU restrictions. It operates at the resource level during deployment and lifecycle, not at the user sign-in level. Authenticating a user with an additional factor is outside the scope of Azure Policy, which cannot mandate or verify the identity proof process.
- ✗
Azure Privileged Identity Management
Why it's wrong here
Azure Privileged Identity Management (PIM) is an identity governance tool that grants just-in-time, time-bound, and approval-required access to privileged Azure AD roles. While PIM can be configured to require MFA when a user activates a role, it does not provide the verification factor itself; it leverages Azure AD MFA as a dependency. Its purpose is to control privilege elevation and monitor access, not to serve as the universal authentication mechanism that protects all user sign-ins.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Azure Active Directory
Azure Active Directory is Microsoft's cloud-based identity and access management service that lets employees sign in and access resources both in the cloud and on-premises.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.