WGU E033 | AZURE IDENTITY & GOVERNANCE | 2026–2027
WGU E033 Azure Identity &
Governance Review
2026–2027 | 110 Practice Questions with Detailed Rationales
High-Yield Review
Identity vs authorization: Microsoft Entra ID authenticates and manages identities; Azure RBAC
controls Azure resource authorization; Microsoft Entra roles administer directory features.
Least privilege: Assign roles at the narrowest effective scope, distinguish management-plane and data-
plane roles, and review entitlements.
Conditional Access: Evaluate users, apps, device state, location, risk and session conditions; use
report-only testing and protect emergency access.
Privileged identity: PIM eligible assignments and time-bound activation reduce standing privilege;
monitor and periodically review assignments.
Workload identity: Prefer managed identities or federation over embedded secrets when supported;
scope app permissions carefully.
Governance: Management groups, Azure Policy, tags, resource locks, and exception workflows serve
different functions.
Lifecycle and monitoring: Use provisioning/deprovisioning, access reviews, sign-in and audit logs,
identity risk detection, and SOC correlation.
Original educational resource • Page 1
,WGU E033 | AZURE IDENTITY & GOVERNANCE | 2026–2027
Identity fundamentals
Question 1. An organization wants one identity platform for employees signing in to Azure and
Microsoft 365. Which Azure identity or governance solution is most appropriate?
A. Azure DNS
B. Azure Backup
C. Azure Monitor
D. Microsoft Entra ID
Correct Answer: D. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and access management.
Why the Other Options Are Incorrect: A — Azure DNS does not provide the specific identity,
authorization, governance, or security control required by this scenario. B — Azure Backup does
not provide the specific identity, authorization, governance, or security control required by this
scenario. C — Azure Monitor does not provide the specific identity, authorization, governance, or
security control required by this scenario.
Question 2. Architecture validation: An organization wants one identity platform for employees
signing in to Azure and Microsoft 365. Which recommendation best addresses this requirement
while limiting unnecessary access or operational risk?
A. Microsoft Entra ID
B. Azure DNS
C. Azure Backup
D. Azure Monitor
Correct Answer: A. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and access management.
Why the Other Options Are Incorrect: B — Azure DNS does not provide the specific identity,
authorization, governance, or security control required by this scenario. C — Azure Backup does
not provide the specific identity, authorization, governance, or security control required by this
scenario. D — Azure Monitor does not provide the specific identity, authorization, governance, or
security control required by this scenario.
Original educational resource • Page 2
,WGU E033 | AZURE IDENTITY & GOVERNANCE | 2026–2027
Question 3. An organization maintains on-premises AD DS and needs synchronized hybrid
identities. Which Azure identity or governance solution is most appropriate?
A. Azure Firewall
B. Microsoft Entra Connect Sync or Cloud Sync
C. Azure Front Door
D. Azure Bastion
Correct Answer: B. Microsoft Entra Connect Sync or Cloud Sync
Detailed Rationale: Hybrid identity synchronization connects supported on-premises identities
with Entra ID.
Why the Other Options Are Incorrect: A — Azure Firewall does not provide the specific identity,
authorization, governance, or security control required by this scenario. C — Azure Front Door
does not provide the specific identity, authorization, governance, or security control required by
this scenario. D — Azure Bastion does not provide the specific identity, authorization, governance,
or security control required by this scenario.
Question 4. Architecture validation: An organization maintains on-premises AD DS and needs
synchronized hybrid identities. Which recommendation best addresses this requirement while
limiting unnecessary access or operational risk?
A. Azure Bastion
B. Azure Firewall
C. Microsoft Entra Connect Sync or Cloud Sync
D. Azure Front Door
Correct Answer: C. Microsoft Entra Connect Sync or Cloud Sync
Detailed Rationale: Hybrid identity synchronization connects supported on-premises identities
with Entra ID.
Why the Other Options Are Incorrect: A — Azure Bastion does not provide the specific identity,
authorization, governance, or security control required by this scenario. B — Azure Firewall does
not provide the specific identity, authorization, governance, or security control required by this
scenario. D — Azure Front Door does not provide the specific identity, authorization, governance,
or security control required by this scenario.
Original educational resource • Page 3
, WGU E033 | AZURE IDENTITY & GOVERNANCE | 2026–2027
Question 5. A company wants users to access a SaaS application with the same corporate
credentials. Which Azure identity or governance solution is most appropriate?
A. Storage account key
B. Virtual network peering
C. Managed disk snapshot
D. Federated single sign-on
Correct Answer: D. Federated single sign-on
Detailed Rationale: SSO reduces repeated authentication by using a trusted identity provider.
Why the Other Options Are Incorrect: A — Storage account key does not provide the specific
identity, authorization, governance, or security control required by this scenario. B — Virtual
network peering does not provide the specific identity, authorization, governance, or security
control required by this scenario. C — Managed disk snapshot does not provide the specific
identity, authorization, governance, or security control required by this scenario.
Question 6. Architecture validation: A company wants users to access a SaaS application with the
same corporate credentials. Which recommendation best addresses this requirement while
limiting unnecessary access or operational risk?
A. Federated single sign-on
B. Storage account key
C. Virtual network peering
D. Managed disk snapshot
Correct Answer: A. Federated single sign-on
Detailed Rationale: SSO reduces repeated authentication by using a trusted identity provider.
Why the Other Options Are Incorrect: B — Storage account key does not provide the specific
identity, authorization, governance, or security control required by this scenario. C — Virtual
network peering does not provide the specific identity, authorization, governance, or security
control required by this scenario. D — Managed disk snapshot does not provide the specific
identity, authorization, governance, or security control required by this scenario.
Question 7. A contractor should have time-limited collaboration access to a Teams-connected
resource. Which Azure identity or governance solution is most appropriate?
A. ExpressRoute circuit
Original educational resource • Page 4
WGU E033 Azure Identity &
Governance Review
2026–2027 | 110 Practice Questions with Detailed Rationales
High-Yield Review
Identity vs authorization: Microsoft Entra ID authenticates and manages identities; Azure RBAC
controls Azure resource authorization; Microsoft Entra roles administer directory features.
Least privilege: Assign roles at the narrowest effective scope, distinguish management-plane and data-
plane roles, and review entitlements.
Conditional Access: Evaluate users, apps, device state, location, risk and session conditions; use
report-only testing and protect emergency access.
Privileged identity: PIM eligible assignments and time-bound activation reduce standing privilege;
monitor and periodically review assignments.
Workload identity: Prefer managed identities or federation over embedded secrets when supported;
scope app permissions carefully.
Governance: Management groups, Azure Policy, tags, resource locks, and exception workflows serve
different functions.
Lifecycle and monitoring: Use provisioning/deprovisioning, access reviews, sign-in and audit logs,
identity risk detection, and SOC correlation.
Original educational resource • Page 1
,WGU E033 | AZURE IDENTITY & GOVERNANCE | 2026–2027
Identity fundamentals
Question 1. An organization wants one identity platform for employees signing in to Azure and
Microsoft 365. Which Azure identity or governance solution is most appropriate?
A. Azure DNS
B. Azure Backup
C. Azure Monitor
D. Microsoft Entra ID
Correct Answer: D. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and access management.
Why the Other Options Are Incorrect: A — Azure DNS does not provide the specific identity,
authorization, governance, or security control required by this scenario. B — Azure Backup does
not provide the specific identity, authorization, governance, or security control required by this
scenario. C — Azure Monitor does not provide the specific identity, authorization, governance, or
security control required by this scenario.
Question 2. Architecture validation: An organization wants one identity platform for employees
signing in to Azure and Microsoft 365. Which recommendation best addresses this requirement
while limiting unnecessary access or operational risk?
A. Microsoft Entra ID
B. Azure DNS
C. Azure Backup
D. Azure Monitor
Correct Answer: A. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and access management.
Why the Other Options Are Incorrect: B — Azure DNS does not provide the specific identity,
authorization, governance, or security control required by this scenario. C — Azure Backup does
not provide the specific identity, authorization, governance, or security control required by this
scenario. D — Azure Monitor does not provide the specific identity, authorization, governance, or
security control required by this scenario.
Original educational resource • Page 2
,WGU E033 | AZURE IDENTITY & GOVERNANCE | 2026–2027
Question 3. An organization maintains on-premises AD DS and needs synchronized hybrid
identities. Which Azure identity or governance solution is most appropriate?
A. Azure Firewall
B. Microsoft Entra Connect Sync or Cloud Sync
C. Azure Front Door
D. Azure Bastion
Correct Answer: B. Microsoft Entra Connect Sync or Cloud Sync
Detailed Rationale: Hybrid identity synchronization connects supported on-premises identities
with Entra ID.
Why the Other Options Are Incorrect: A — Azure Firewall does not provide the specific identity,
authorization, governance, or security control required by this scenario. C — Azure Front Door
does not provide the specific identity, authorization, governance, or security control required by
this scenario. D — Azure Bastion does not provide the specific identity, authorization, governance,
or security control required by this scenario.
Question 4. Architecture validation: An organization maintains on-premises AD DS and needs
synchronized hybrid identities. Which recommendation best addresses this requirement while
limiting unnecessary access or operational risk?
A. Azure Bastion
B. Azure Firewall
C. Microsoft Entra Connect Sync or Cloud Sync
D. Azure Front Door
Correct Answer: C. Microsoft Entra Connect Sync or Cloud Sync
Detailed Rationale: Hybrid identity synchronization connects supported on-premises identities
with Entra ID.
Why the Other Options Are Incorrect: A — Azure Bastion does not provide the specific identity,
authorization, governance, or security control required by this scenario. B — Azure Firewall does
not provide the specific identity, authorization, governance, or security control required by this
scenario. D — Azure Front Door does not provide the specific identity, authorization, governance,
or security control required by this scenario.
Original educational resource • Page 3
, WGU E033 | AZURE IDENTITY & GOVERNANCE | 2026–2027
Question 5. A company wants users to access a SaaS application with the same corporate
credentials. Which Azure identity or governance solution is most appropriate?
A. Storage account key
B. Virtual network peering
C. Managed disk snapshot
D. Federated single sign-on
Correct Answer: D. Federated single sign-on
Detailed Rationale: SSO reduces repeated authentication by using a trusted identity provider.
Why the Other Options Are Incorrect: A — Storage account key does not provide the specific
identity, authorization, governance, or security control required by this scenario. B — Virtual
network peering does not provide the specific identity, authorization, governance, or security
control required by this scenario. C — Managed disk snapshot does not provide the specific
identity, authorization, governance, or security control required by this scenario.
Question 6. Architecture validation: A company wants users to access a SaaS application with the
same corporate credentials. Which recommendation best addresses this requirement while
limiting unnecessary access or operational risk?
A. Federated single sign-on
B. Storage account key
C. Virtual network peering
D. Managed disk snapshot
Correct Answer: A. Federated single sign-on
Detailed Rationale: SSO reduces repeated authentication by using a trusted identity provider.
Why the Other Options Are Incorrect: B — Storage account key does not provide the specific
identity, authorization, governance, or security control required by this scenario. C — Virtual
network peering does not provide the specific identity, authorization, governance, or security
control required by this scenario. D — Managed disk snapshot does not provide the specific
identity, authorization, governance, or security control required by this scenario.
Question 7. A contractor should have time-limited collaboration access to a Teams-connected
resource. Which Azure identity or governance solution is most appropriate?
A. ExpressRoute circuit
Original educational resource • Page 4
