Exam AZ-305 topic 1 question 42 discussion

Actual exam question from Microsoft's AZ-305

Question #: 42
Topic #: 1

You have an Azure AD tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned memberships. Group1 has 50 members, including 20 guest users.

You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements:

• The evaluation must be repeated automatically every three months.
• Every member must be able to report whether they need to be in Group1.
• Users who report that they do not need to be in Group1 must be removed from Group1 automatically.
• Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.

What should you include in the recommendation?

A. Implement Azure AD Identity Protection.
B. Change the Membership type of Group1 to Dynamic User.
C. Create an access review.
D. Implement Azure AD Privileged Identity Management (PIM).

Show Suggested Answer

Suggested Answer: C 🗳️

by IRISone at Jan. 16, 2023, 11:46 a.m.

Comments

Submit Cancel

darthfodio

Highly Voted 2 years, 4 months ago

Selected Answer: C

Based on the requirements below: The evaluation must be repeated automatically every three months. • Every member must be able to report whether they need to be in Group1. • Users who report that they do not need to be in Group1 must be removed from Group1 automatically. • Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. The correct answer should be - C. Create an access. review. https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

upvoted 39 times

...

GuyForget

Highly Voted 2 years ago

How is this a legit question? The clear answer should be to configure an Access Review, but this is configured through PIM, so would they mark both C & D correct?

upvoted 6 times

AdventureChick

1 year, 9 months ago

It's always "choose the BEST answer based on the scenario". Setting up an Access Review is required in order to meet the criteria. Best Answer. Period. Full stop. Yes, Access Review is part of PIM, but PIM by itself doesn't meet the criteria (i.e. you could have PIM and say "screw that Access Review thing"). I have a bunch of MS certs, and regardless of the test, they give you a lot of questions where you can't decided between 2 answers because both are "sort of right depending on how you look at it". Those answers? It's always some little detail in the scenario that decides the Best answer. In this question, they are testing if you know the difference between PIM & Access Control. Someone who skims through material might remember PIM = reporting and not get in deep enough to know what Access Control is. There is method to their madness ... even if it bugs the crap out of us.

upvoted 20 times

...