AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure AD B2C

  Why it's wrong here

  Azure AD B2C is a customer identity and access management service designed for external identities, such as consumers who sign in with social accounts or local accounts in customer-facing applications. It does not connect to or synchronize an on-premises Active Directory environment; it manages identities stored in the B2C directory itself. Therefore, it is incorrect because its purpose is to serve external customers, not to bridge on-prem AD identities to Azure AD.

• ✓

  Azure AD Connect

  Why this is correct

  Azure AD Connect is Microsoft's on-premises identity synchronization tool that connects an existing on-premises Active Directory with Azure AD, replicating user accounts, groups, password hashes, and other directory attributes. It enables hybrid identity features such as password hash synchronization, pass-through authentication, and federation with Active Directory Federation Services (AD FS), as well as seamless single sign-on (SSO). This is exactly the scenario described in the question, making it the correct answer for synchronizing on-prem AD to Azure AD.

• ✗

  Azure Active Directory Domain Services

  Why it's wrong here

  Azure Active Directory Domain Services (Azure AD DS) provides managed domain services in the cloud, such as domain join, Group Policy, and Kerberos/NTLM authentication, for Azure-hosted virtual machines and workloads. It relies on identities that have already been synchronized to Azure AD through a separate synchronization tool, and it does not copy on-premises AD objects into Azure AD itself. This makes it incorrect because it consumes synced identity data rather than generating that synchronization, which is the role of Azure AD Connect.

• ✗

  Azure Conditional Access

  Why it's wrong here

  Azure Conditional Access is an identity-driven policy engine that evaluates signals like user location, device compliance, and risk level to allow or block access to resources. It operates at authentication time and only works with identities that already exist in Azure AD; it has no capability to replicate or synchronize objects from an on-premises Active Directory. Thus, it is wrong because it enforces access decisions on synced identities, rather than performing the synchronization itself.

Go deeper

Related to this question