A user has an eligible assignment for a role in Microsoft Entra PIM. What must the user do to gain the role's permissions?

Use the role without activation

You are configuring Microsoft Entra Privileged Identity Management (PIM) settings for an Azure role. Which setting requires a user to provide a justification when activating the role?

Require justification on activation

Your organization has a resource group named 'RG-Storage' that contains storage accounts. The storage team needs to manage the storage accounts but should not be able to access the data inside them. You need to assign the appropriate role. What should you do?

Assign the Storage Blob Data Contributor role to the storage team at the RG-Storage scope.

Assign the Storage Account Contributor role to the storage team at the RG-Storage scope.

Assign the Reader role to the storage team at the RG-Storage scope.

Assign the Contributor role to the storage team at the RG-Storage scope.

A company has a custom Azure role named 'Support Engineer' that currently includes permissions to read and write virtual machines. The security team wants to add the ability to restart virtual machines, but they want to ensure that the role cannot be used to create or delete virtual machines. What should they do?

Add the restart action to the 'notActions' list of the custom role.

Create a new custom role that includes the restart action and assign it to the same users.

Assign the Virtual Machine Contributor role to the users who have the custom role.

Edit the custom role definition and add the action 'Microsoft.Compute/virtualMachines/restart/action' to the 'actions' list.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 1

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 3)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

15–20%of the exam

Questions 11–15

11foundation · easy
You need to grant a user the ability to manage virtual machines in a resource group, but not allow them to create or delete other resource groups. Which Azure built-in role should you assign?
Select an answer first
12foundation · easy
A user has an eligible assignment for a role in Microsoft Entra PIM. What must the user do to gain the role's permissions?
Select an answer first
13foundation · easy
You are configuring Microsoft Entra Privileged Identity Management (PIM) settings for an Azure role. Which setting requires a user to provide a justification when activating the role?
Select an answer first
14application · medium
Your organization has a resource group named 'RG-Storage' that contains storage accounts. The storage team needs to manage the storage accounts but should not be able to access the data inside them. You need to assign the appropriate role. What should you do?
Select an answer first
15application · medium
A company has a custom Azure role named 'Support Engineer' that currently includes permissions to read and write virtual machines. The security team wants to add the ability to restart virtual machines, but they want to ensure that the role cannot be used to create or delete virtual machines. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 3)

Questions 11–15

You need to grant a user the ability to manage virtual machines in a resource group, but not allow them to create or delete other resource groups. Which Azure built-in role should you assign?

A user has an eligible assignment for a role in Microsoft Entra PIM. What must the user do to gain the role's permissions?

You are configuring Microsoft Entra Privileged Identity Management (PIM) settings for an Azure role. Which setting requires a user to provide a justification when activating the role?

Your organization has a resource group named 'RG-Storage' that contains storage accounts. The storage team needs to manage the storage accounts but should not be able to access the data inside them. You need to assign the appropriate role. What should you do?

Keep studying — Secure identity and access