AZ-104 Certification Practice Question #149

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) domain.

The domain contains the identities shown in the following table.

You have an Azure subscription that contains a storage account named storage1. The file shares in storage1 have an identity source of AD DS and Default share-level permissions set to Enable permissions for all authenticated users and groups.

You create an Azure Files share named share1 that has the roles shown in the following table.

You have a Microsoft Entra tenant that contains a cloud-only user named User3.

You use Microsoft Entra Connect to sync OU1 from the AD DS domain to the Microsoft Entra tenant.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

1. **User1 (No):** User1 is located in `OU2`, which is excluded from the Microsoft Entra Connect synchronization scope. Because of this, User1's identity is not synchronized to Microsoft Entra, even though they belong to `Group1` (which is in `OU1` and synchronized). Without an Entra ID identity, User1 cannot authenticate against Azure AD/Entra ID for Azure Files access.
2. **User2 (Yes):** User2 is located in `OU1`, which is successfully synchronized to Microsoft Entra. Additionally, `storage1` has default share-level permissions configured to allow access for all authenticated users. Since User2 is synchronized and authenticated, they inherit this permission and can access the share.
3. **User3 (No):** User3 is a cloud-only user. Since `share1` uses on-premises Active Directory Domain Services (AD DS) as the identity source, authentication relies on AD DS credentials. Cloud-only users do not have AD DS credentials in the on-premises domain, so they cannot authenticate and are denied access.

More AZ-104 practice questions