Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   You need to assign a user to a privileged role in Microsoft Entra PIM for a limited time. Which type of assignment should you create?

   • AActive assignment
   • BTime-bound assignment
   • CPermanent assignment
   • DEligible assignment
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   You need to create a Conditional Access policy that requires MFA when users access the company's SharePoint Online from outside the corporate network. Which two components must you configure in the policy?

   • AAssignments and Access controls
   • BCloud apps and Sign-in risk
   • CUsers and Groups only
   • DGrant and Session controls only
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   Your company has a custom Azure RBAC role named 'DB-Support' that includes Microsoft.Sql/servers/databases/read and Microsoft.Sql/servers/databases/write. The role is assigned to the 'DBAs' group at the subscription scope. The security team wants to restrict the DBAs so they can only manage databases in the 'RG-SQL' resource group. You need to modify the role assignment to meet this requirement without changing the role definition. What should you do?

   • AAdd a deny assignment for the DBAs group at the subscription scope.
   • BCreate a new custom role with the same actions and assign it at the RG-SQL scope.
   • CChange the role definition to include Microsoft.Sql/servers/databases/delete and keep the subscription scope.
   • DRemove the subscription-scope assignment and assign the same role at the RG-SQL scope.
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   Your organization has a resource group named 'RG-Network' that contains virtual networks and network security groups. The network team needs to manage these resources but should not be able to create or delete virtual machines. You need to assign the appropriate role. What should you do?

   • AAssign the Contributor role to the network team at the RG-Network scope.
   • BAssign the Network Contributor role to the network team at the RG-Network scope.
   • CAssign the Virtual Machine Contributor role to the network team at the RG-Network scope.
   • DCreate a custom role with Microsoft.Network/* permissions and assign it at the subscription scope.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization wants to reduce the risk of standing privileges for Azure AD roles. They have already implemented PIM and made all assignments eligible. What additional PIM setting should they configure to further reduce the risk of dormant accounts retaining access?

   • ASet the activation maximum duration to the shortest possible value that still allows users to perform their tasks.
   • BDisable the ability to activate roles outside of business hours.
   • CSet up alerts for role activations.
   • DRequire Azure AD Multi-Factor Authentication (MFA) on activation.
   Reveal Solution Discussion Select an answer first