AZ-900 Security, Identity and Privacy Questions
Identity is the thread running through this whole section. Most questions come down to knowing who is being verified, what they are allowed to do, and which service enforces it.
Loading questions…
Drawing 10 at random from 21 questions. Reload for a different set.
Every domain, offline, no ads
- The full question bank across all four AZ-900 domains
- Every answer explained in detail
- Works with no connection at all
- Track your score history and streaks
What to know for this section
Authentication is not authorization
Authentication answers "who are you" — proving identity with a password, a token or a biometric. Authorization answers "what may you do" — the permissions granted once identity is established. The exam asks this directly and rewards being precise about it.
Multi-factor authentication
MFA requires evidence from at least two different categories: something you know (a password), something you have (a phone or hardware token), and something you are (a fingerprint or face). Two passwords are not MFA, because both come from the same category.
Defence in depth
Security is layered rather than perimeter-only: physical, identity, network, compute, application and data, each independently defended, so one breached layer does not expose everything behind it.