A company is developing an API that will be used by multiple client apps. The API needs to support both user-level and app-level access. The security team wants to ensure that the API can differentiate between the two. What should they configure in the API's app registration?

Define both delegated scopes and application roles in the API's app registration.

Use the same scope for both user and app access.

Define only delegated scopes and require users to consent.

Define only application roles and require admin consent.

A company is using a third-party application that requests permissions to read all users' profiles and sign in users. The security team wants to review and approve the permissions before any user can use the application. What should they do?

Review the requested permissions and grant admin consent for the application.

Allow users to consent individually and monitor the consent activity.

Create a conditional access policy to require MFA for the application.

Block the application and ask the vendor to reduce permissions.

A company is developing a solution that uses an Azure Function to process messages from a Service Bus queue. The function needs to read messages from the queue. The security team mandates that no connection strings or secrets be used. What should you do?

Enable a system-assigned managed identity on the function app and assign it the Azure Service Bus Data Receiver role on the queue.

Assign the function app's system-assigned managed identity the Contributor role on the Service Bus namespace.

Use the Service Bus connection string from the function app's application settings.

Create a service principal and store its client secret in the function app's environment variables.

A company is migrating a legacy application to Azure VMs. The application needs to authenticate to Azure Key Vault to retrieve secrets. The security team requires that no secrets be stored in the VM image or configuration. They also want to minimize the number of identities to manage. What should they do?

Enable a system-assigned managed identity on the VM and grant it the Key Vault Secrets User role.

Use the VM's local administrator account to authenticate to Key Vault.

Create a service principal with a client secret and store the secret in the VM's environment variables.

Create a user-assigned managed identity and assign it to the VM, then grant it the Key Vault Contributor role.

What is the primary benefit of using a managed identity for an Azure resource?

It provides a separate identity for each user of the application

It allows the resource to be accessed from any network

It eliminates the need to store credentials in code or configuration files

It automatically grants the resource access to all Azure resources

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 2

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 3)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

15–20%of the exam

Questions 11–15

11expert · medium
A company is developing an API that will be used by multiple client apps. The API needs to support both user-level and app-level access. The security team wants to ensure that the API can differentiate between the two. What should they configure in the API's app registration?
Select an answer first
12application · medium
A company is using a third-party application that requests permissions to read all users' profiles and sign in users. The security team wants to review and approve the permissions before any user can use the application. What should they do?
Select an answer first
13application · medium
A company is developing a solution that uses an Azure Function to process messages from a Service Bus queue. The function needs to read messages from the queue. The security team mandates that no connection strings or secrets be used. What should you do?
Select an answer first
14expert · medium
A company is migrating a legacy application to Azure VMs. The application needs to authenticate to Azure Key Vault to retrieve secrets. The security team requires that no secrets be stored in the VM image or configuration. They also want to minimize the number of identities to manage. What should they do?
Select an answer first
15foundation · easy
What is the primary benefit of using a managed identity for an Azure resource?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.