Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization is using a third-party application that requires the Mail.Read permission. The security team wants to allow users to consent to this permission, but they want to prevent users from granting permissions that allow the app to send email. What should you configure?

   • APre-consent the application for all permissions and allow users to sign in.
   • BUse conditional access to block the Mail.Send permission.
   • CEnable user consent for permissions classified as low impact, and require admin consent for permissions classified as high impact.
   • DDisable all user consent and have users request admin consent for every permission.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A developer needs to register a new web API in Microsoft Entra ID. The API will be called by multiple client applications. The developer wants to define the permissions that the API exposes. What should the developer configure in the app registration?

   • AExpose an API and define scopes and application roles.
   • BAdd a client secret and set redirect URIs.
   • CAssign the API to the Enterprise Application and set user assignment required.
   • DConfigure the application to be multi-tenant.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A development team is deploying an Azure Function that must read from an Azure Storage account. The team wants to avoid storing any credentials in code or configuration. What should they use to authenticate the Function to the Storage account?

   • AThe storage account access key stored as an environment variable in the Function App settings.
   • BA service principal created from an app registration, with a client secret stored in Azure Key Vault.
   • CA user-assigned managed identity created in the tenant, assigned to the Function App, and a role assignment for Storage Blob Data Contributor.
   • DA system-assigned managed identity enabled on the Function App, with a role assignment granting Storage Blob Data Reader on the storage account.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization has a custom application that runs on an on-premises server and needs to access Microsoft Graph to read directory data. The application cannot use managed identities because it is not hosted in Azure. What should you create to allow the application to authenticate securely?

   • AA system-assigned managed identity for the on-premises server.
   • BA user account with a strong password and use that for authentication.
   • CAn app registration with a client secret, and use the service principal to authenticate.
   • DAn Azure AD application proxy to expose the application.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization is using a third-party application that requests the 'Files.ReadWrite.All' delegated permission. The security team is concerned about the risk. They want to allow the application to be used but only with read-only access to files. What should they do?

   • ABlock the application entirely.
   • BGrant admin consent for Files.ReadWrite.All and rely on conditional access policies.
   • CAsk the vendor to provide a version that requests only Files.Read, then grant admin consent for that permission.
   • DAllow users to consent individually and hope they choose read-only.
   Reveal Solution Discussion Select an answer first