A company uses PIM for Azure AD roles. They have a role assignment for a user that is set to 'Active' for the Global Administrator role. The security team wants to enforce that the user must activate the role each time they need it, and they want to require MFA on activation. What should they do?

Change the assignment from 'Active' to 'Eligible' and configure the role settings to require MFA on activation.

Create a Conditional Access policy that requires MFA for the Global Administrator role.

Change the assignment to 'Eligible' and require the user to use a separate account for activation.

Keep the assignment as 'Active' and configure the role settings to require MFA on activation.

You need to ensure that when a user activates a privileged role in Microsoft Entra PIM, they must use multi-factor authentication. Which PIM setting should you enable?

Require justification on activation

A company has an Azure subscription with a resource group named 'RG-Prod' that contains virtual machines. The security team needs to grant a group of developers the ability to start and stop virtual machines in RG-Prod, but they must not be able to create or delete virtual machines or modify other resources. What should they do?

Create a custom role with permissions 'Microsoft.Compute/virtualMachines/start/action' and 'Microsoft.Compute/virtualMachines/restart/action' and assign it to the developers' group at the resource group scope.

Assign the Virtual Machine Operator role to the developers' group at the resource group scope.

Assign the Contributor role to the developers' group at the resource group scope.

Assign the Virtual Machine Contributor role to the developers' group at the resource group scope.

Your organization uses PIM to manage the 'User Access Administrator' role. The security team wants to reduce the risk of standing access while ensuring that at least one administrator can always activate the role. Currently, the role has two eligible assignments: User A and User B. The role settings require approval for activation. You need to ensure that if one administrator is unavailable, the other can still activate the role without delay. What should you configure?

Add a third eligible assignment to the role.

Set the activation duration to 8 hours.

Configure the role settings to not require approval for activation.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 1

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 4)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

15–20%of the exam

Questions 16–20

16expert · medium
A company uses PIM for Azure AD roles. They have a role assignment for a user that is set to 'Active' for the Global Administrator role. The security team wants to enforce that the user must activate the role each time they need it, and they want to require MFA on activation. What should they do?
Select an answer first
17foundation · easy
You need to ensure that when a user activates a privileged role in Microsoft Entra PIM, they must use multi-factor authentication. Which PIM setting should you enable?
Select an answer first
18application · medium
A company has an Azure subscription with a resource group named 'RG-Prod' that contains virtual machines. The security team needs to grant a group of developers the ability to start and stop virtual machines in RG-Prod, but they must not be able to create or delete virtual machines or modify other resources. What should they do?
Select an answer first
19foundation · easy
You need to update an existing custom Azure role to add a new permission. Which Azure PowerShell cmdlet should you use to modify the role definition?
Select an answer first
20expert · hard
Your organization uses PIM to manage the 'User Access Administrator' role. The security team wants to reduce the risk of standing access while ensuring that at least one administrator can always activate the role. Currently, the role has two eligible assignments: User A and User B. The role settings require approval for activation. You need to ensure that if one administrator is unavailable, the other can still activate the role without delay. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 4)

Questions 16–20

A company uses PIM for Azure AD roles. They have a role assignment for a user that is set to 'Active' for the Global Administrator role. The security team wants to enforce that the user must activate the role each time they need it, and they want to require MFA on activation. What should they do?

You need to ensure that when a user activates a privileged role in Microsoft Entra PIM, they must use multi-factor authentication. Which PIM setting should you enable?

You need to update an existing custom Azure role to add a new permission. Which Azure PowerShell cmdlet should you use to modify the role definition?

Keep studying — Secure identity and access