A user with an eligible PIM assignment for the 'Billing Reader' role attempts to activate the role but is told that activation requires approval. The approver is on vacation and cannot approve. The user needs access immediately to resolve a billing issue. What should you do to allow the user to activate the role without waiting for the approver?

Add the user as a permanent assignment to the Billing Reader role.

Create a new role with the same permissions and assign it to the user.

Temporarily change the role settings to not require approval, have the user activate, then revert the setting.

Ask the user to wait until the approver returns.

You need to temporarily disable a Conditional Access policy without deleting it. What should you do in the Microsoft Entra admin center?

Change the policy to Report-only

A user in your organization is assigned the 'Security Administrator' role in Microsoft Entra PIM as an eligible assignment. When the user tries to activate the role, they receive an error that activation is not allowed. You need to determine the most likely cause. What should you check first?

The user's Azure AD role to see if they are already permanently assigned the Security Administrator role.

The user's license assignment to ensure they have a PIM license.

The role settings for Security Administrator to see if activation requires approval or MFA that the user has not completed.

The Conditional Access policies to see if they block the user's sign-in.

A company has a resource group that contains a web app and a SQL database. A team of developers needs to be able to view the web app's configuration and restart the web app, but they should not be able to modify the SQL database or manage the resource group. What is the most appropriate built-in role assignment?

Assign the Website Contributor role at the resource group scope.

Assign the Contributor role at the resource group scope.

Assign the Web App Contributor role at the resource group scope.

Assign the Web Plan Contributor role at the resource group scope.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 1

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 6)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

15–20%of the exam

Questions 26–30

26expert · hard
A user with an eligible PIM assignment for the 'Billing Reader' role attempts to activate the role but is told that activation requires approval. The approver is on vacation and cannot approve. The user needs access immediately to resolve a billing issue. What should you do to allow the user to activate the role without waiting for the approver?
Select an answer first
27foundation · easy
You need to temporarily disable a Conditional Access policy without deleting it. What should you do in the Microsoft Entra admin center?
Select an answer first
28application · medium
A user in your organization is assigned the 'Security Administrator' role in Microsoft Entra PIM as an eligible assignment. When the user tries to activate the role, they receive an error that activation is not allowed. You need to determine the most likely cause. What should you check first?
Select an answer first
29foundation · easy
You need to modify an existing Conditional Access policy to add a new cloud app to the policy's assignments. In which section of the policy should you make this change?
Select an answer first
30application · medium
A company has a resource group that contains a web app and a SQL database. A team of developers needs to be able to view the web app's configuration and restart the web app, but they should not be able to modify the SQL database or manage the resource group. What is the most appropriate built-in role assignment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 6)

Questions 26–30

You need to temporarily disable a Conditional Access policy without deleting it. What should you do in the Microsoft Entra admin center?

A user in your organization is assigned the 'Security Administrator' role in Microsoft Entra PIM as an eligible assignment. When the user tries to activate the role, they receive an error that activation is not allowed. You need to determine the most likely cause. What should you check first?

You need to modify an existing Conditional Access policy to add a new cloud app to the policy's assignments. In which section of the policy should you make this change?

Keep studying — Secure identity and access