A company uses a third-party SaaS application that requires access to read user calendars. The company wants to allow only the sales team to use this application and wants to prevent other employees from seeing consent prompts. What should you configure in Microsoft Entra ID?

Enable user consent for all users and let each user consent individually.

Assign the sales team to the enterprise application and grant admin consent for the required permissions.

Set the application to be multi-tenant and require user assignment.

Create a conditional access policy that requires the sales team to be in a specific location.

A company has a Kubernetes cluster in Azure (AKS) that needs to access Azure Container Registry (ACR) to pull images. The team wants to avoid using admin credentials for ACR. What should they do?

Use the cluster's kubelet identity (managed identity) and grant it the AcrPull role on the ACR.

Use the ACR admin account and store the credentials in a Kubernetes secret.

Enable the ACR to be publicly accessible and use anonymous pull.

Create a service principal with a client secret and configure the cluster to use it for ACR authentication.

An organization is using a third-party application that requires the Files.ReadWrite.All permission. The security team wants to allow users to consent to this permission, but they want to require admin approval for any permission that can write data. What should you configure?

Classify the Files.ReadWrite.All permission as 'Requires admin consent' in the permission classification.

Use conditional access to block the application when it requests write permissions.

Enable user consent for all permissions and rely on the application's terms of use.

Pre-consent the application for all permissions.

An app registration exposes an API that needs to be called by a client app. The API requires that the client app has a specific permission to read data. The client app is developed by the same organization. What should you do to enable the client app to call the API without requiring user interaction?

Expose an application permission in the API app registration, then grant admin consent for that permission to the client app.

Add the client app as an owner of the API app registration and use the client ID as the permission.

Expose a delegated permission in the API app registration and have the client app request it during user sign-in.

Create a new app registration for the API and assign the client app the Application.ReadWrite.All role.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 2

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 6)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

15–20%of the exam

Questions 26–30

26application · medium
A company uses a third-party SaaS application that requires access to read user calendars. The company wants to allow only the sales team to use this application and wants to prevent other employees from seeing consent prompts. What should you configure in Microsoft Entra ID?
Select an answer first
27expert · medium
A company has a Kubernetes cluster in Azure (AKS) that needs to access Azure Container Registry (ACR) to pull images. The team wants to avoid using admin credentials for ACR. What should they do?
Select an answer first
28application · medium
An organization is using a third-party application that requires the Files.ReadWrite.All permission. The security team wants to allow users to consent to this permission, but they want to require admin approval for any permission that can write data. What should you configure?
Select an answer first
29application · medium
An app registration exposes an API that needs to be called by a client app. The API requires that the client app has a specific permission to read data. The client app is developed by the same organization. What should you do to enable the client app to call the API without requiring user interaction?
Select an answer first
30foundation · easy
Which permission type in Microsoft Entra ID ALWAYS requires administrator consent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Microsoft Entra Application Access and Managed Identities AZ-500 Practice Questions (Page 6)

Questions 26–30

A company uses a third-party SaaS application that requires access to read user calendars. The company wants to allow only the sales team to use this application and wants to prevent other employees from seeing consent prompts. What should you configure in Microsoft Entra ID?

A company has a Kubernetes cluster in Azure (AKS) that needs to access Azure Container Registry (ACR) to pull images. The team wants to avoid using admin credentials for ACR. What should they do?

An organization is using a third-party application that requires the Files.ReadWrite.All permission. The security team wants to allow users to consent to this permission, but they want to require admin approval for any permission that can write data. What should you configure?

Which permission type in Microsoft Entra ID ALWAYS requires administrator consent?

Keep studying — Secure identity and access