I85PREP
⌘ K
Azure AZ-500 study materials
Azure AZ-500 study resources

Azure AZ-500 practice questions

One question at a time. Build your Azure AZ-500 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Secure identity and access

A team member must be able to create and manage all resources in a resource group but must not be able to grant access to other users. Which built-in Azure role should be assigned?

  1. Owner
  2. Reader
  3. User Access Administrator
  4. Contributor Correct answer.

Explanation

Contributor grants full management of resources but deliberately excludes the ability to create role assignments, so the user cannot grant access to others. Owner adds access management on top of Contributor, and User Access Administrator grants only access management.

Question 2Secure identity and access

A user is given an eligible assignment to the Security Administrator role in Privileged Identity Management. What must the user do before the role permissions take effect?

  1. Activate the assignment for a limited time Correct answer.
  2. Sign in with a FIDO2 security key
  3. Wait for the assignment to synchronize from on-premises AD
  4. Accept a terms of use policy

Explanation

Eligible assignments are inert until the user activates them, which produces a time-bound active assignment and can enforce MFA, justification and approval. Activation is the mechanism that converts eligibility into actual permissions.

Question 3Secure identity and access

Which Microsoft Entra authentication method is considered phishing-resistant by design?

  1. Security questions
  2. Voice call
  3. SMS one-time passcode
  4. FIDO2 security key Correct answer.

Explanation

FIDO2 security keys bind the credential to the origin of the relying party, so a code or assertion captured by a phishing site cannot be replayed. Codes, calls and knowledge-based questions can all be relayed to an attacker in real time.

Question 4Secure identity and access

An external partner is invited to collaborate through Microsoft Entra B2B. Which type of directory object is created for that partner in the inviting tenant?

  1. Service principal
  2. Mail-enabled security group
  3. Managed identity
  4. Guest user account Correct answer.

Explanation

B2B collaboration creates a guest user object in the resource tenant that authenticates with the partner's home credentials. That object is governed by external collaboration settings and guest Conditional Access policies.

Question 5Secure identity and access

When is a system-assigned managed identity removed from Microsoft Entra ID?

  1. When an administrator removes it from the resource group
  2. When the credentials issued to the identity expire
  3. When the resource is stopped or deallocated
  4. When the Azure resource that owns it is deleted Correct answer.

Explanation

A system-assigned managed identity shares the lifecycle of the Azure resource that created it, so it is deleted together with that resource. It cannot be deleted independently while the parent resource still exists.

Question 6Secure identity and access

Which Microsoft Entra built-in role is required to create users and groups and to reset passwords for non-administrative users?

  1. Billing Administrator
  2. Global Reader
  3. User Administrator Correct answer.
  4. Security Reader

Explanation

User Administrator can create and manage users and groups and reset passwords for non-administrators, and can manage most support tickets. The reader roles grant visibility only, and Billing Administrator is limited to subscription billing tasks.

Question 7Secure identity and access

What is the recommended way to configure emergency access accounts so that a Conditional Access misconfiguration cannot lock every administrator out?

  1. Add them to the Global Administrator role only during incidents
  2. Protect them with security questions instead of MFA
  3. Exclude them from all Conditional Access policies Correct answer.
  4. License them for Entra ID P2 and include them in every policy

Explanation

At least two cloud-only emergency accounts should be permanently excluded from every Conditional Access policy so there is always a path into the tenant. They should also use strong, separate credentials and be monitored for any use.

Question 8Secure identity and access

Microsoft Entra Password Protection evaluates a proposed password against which list in addition to any tenant custom list?

  1. The user's previous five password hashes
  2. The Microsoft global banned password list Correct answer.
  3. The tenant's custom banned password list only
  4. The on-premises AD fine-grained password policy

Explanation

Password Protection checks the proposed password against the Microsoft global banned list, the tenant custom banned list, and variants produced by common character substitutions. This blocks widely used weak passwords even when they satisfy length and complexity rules.

Question 9Secure identity and access

A Conditional Access policy must allow access to Microsoft 365 only from devices that are managed by the organization. Which grant control should be selected?

  1. Require approved client app
  2. Require password change
  3. Require terms of use
  4. Require compliant device Correct answer.

Explanation

Requiring a compliant device makes Intune device compliance the condition for access, so unmanaged or noncompliant devices are blocked. Approved client app controls which application is used rather than whether the endpoint is managed.

Question 10Secure identity and access

A company must periodically confirm that guest users still require membership in a Microsoft 365 group. Which Microsoft Entra ID Governance feature should be used?

  1. Access packages
  2. Access reviews Correct answer.
  3. Conditional Access
  4. Privileged Identity Management

Explanation

Access reviews let designated reviewers such as group owners or the guests themselves recertify existing membership on a recurring schedule, with automatic removal when no response is received. They evaluate assignments that already exist rather than provisioning new bundles of access.

Question 11Secure identity and access

An administrator must ensure that a role activation in Privileged Identity Management requires a second person to authorize it. Which activation setting should be enabled?

  1. Require justification on activation
  2. Require ticket information on activation
  3. Require multi-factor authentication on activation
  4. Require approval to activate Correct answer.

Explanation

The require approval setting routes each activation request to nominated approvers who must approve it before the role becomes active. MFA, justification and ticket information collect evidence about the requester but do not add a second authorizer.

Question 12Secure identity and access

Which property of a custom Azure RBAC role definition determines the scopes at which the role can be assigned?

  1. AssignableScopes Correct answer.
  2. NotActions
  3. Actions
  4. DataActions

Explanation

AssignableScopes lists the subscriptions, resource groups or resources in which the custom role may be used in a role assignment. Actions, NotActions and DataActions define what the role permits, not where it can be applied.

Question 13Secure identity and access

Leaked credentials are detected for several user accounts. The security team wants those users forced to change their password at next sign-in. What should be configured?

  1. An access review
  2. A sign-in risk policy
  3. A device compliance policy
  4. A user risk policy Correct answer.

Explanation

A user risk policy in Identity Protection responds to user-level risk such as leaked credentials and can require a secure password change as remediation. Sign-in risk policies instead evaluate the likelihood that a specific authentication attempt is not the account owner.

Question 14Secure identity and access

A business unit wants to bundle a SharePoint site, a group and a Teams channel so that internal and external users can request them with manager approval and automatic expiry. Which feature provides this?

  1. Administrative units
  2. Conditional Access
  3. Access packages Correct answer.
  4. Dynamic membership groups

Explanation

Access packages in entitlement management bundle resources and define who may request them, along with approval, expiration and review policies. Dynamic groups assign membership automatically from attribute rules and provide no request or approval workflow.

Question 15Secure identity and access

A multi-tenant application is granted consent by an administrator in a customer tenant. What is created in that customer tenant to represent the application?

  1. A new app registration
  2. A service principal Correct answer.
  3. A managed identity
  4. A guest user

Explanation

Consent creates a service principal, also surfaced as the enterprise application, in the consenting tenant while the app registration stays in the home tenant. That service principal is the local identity the application uses to access resources in the customer tenant.

Question 16Secure identity and access

A new hire has no password, phone or security key yet, and the helpdesk must let them sign in once to register authentication methods. What should the administrator issue?

  1. An invitation to self-service password reset
  2. An app password
  3. A password reset with a shared temporary password
  4. A Temporary Access Pass Correct answer.

Explanation

A Temporary Access Pass is a time-limited passcode issued by an administrator that satisfies MFA and lets the user register passwordless methods. It exists specifically for onboarding and credential recovery scenarios.

Question 17Secure identity and access

A helpdesk team must be able to reset passwords only for users in the Sales department. Which Microsoft Entra construct should be used to scope the delegation?

  1. An administrative unit Correct answer.
  2. A Conditional Access policy
  3. A dynamic device group
  4. A custom Azure RBAC role

Explanation

Administrative units are containers that restrict a directory role assignment to a defined set of users or groups, so a User Administrator assigned at that unit can manage only its members. Groups and Conditional Access policies do not limit the scope of directory roles.

Question 18Secure identity and access

Which Microsoft Entra hybrid identity sign-in method validates passwords against on-premises Active Directory by using a lightweight agent and does not store password hashes in the cloud?

  1. Pass-through authentication Correct answer.
  2. Password hash synchronization
  3. Cloud-only identity
  4. Federation with AD FS

Explanation

Pass-through authentication forwards sign-in attempts to an on-premises agent that validates them against Active Directory, so no password hash is synchronized to Entra ID. Password hash synchronization uploads hashes, and federation delegates authentication to an on-premises security token service.

Question 19Secure identity and access

A Conditional Access policy blocks access from all locations except the corporate datacenter's public IP range. Which configuration defines that trusted range?

  1. A named location Correct answer.
  2. An authentication strength
  3. A terms of use document
  4. An Intune compliance policy

Explanation

Named locations define IP ranges or countries that can be included in or excluded from the location condition of a Conditional Access policy. This is the supported way to identify trusted corporate egress addresses.

Question 20Secure identity and access

An administrator needs to keep Microsoft Entra sign-in logs for one year and query them with KQL. What should be configured?

  1. A weekly manual export of the sign-in report to CSV
  2. A diagnostic setting to a Log Analytics workspace Correct answer.
  3. Security defaults for all users
  4. Access reviews of directory roles

Explanation

Diagnostic settings stream sign-in and audit logs to destinations such as a Log Analytics workspace, storage account or event hub. A Log Analytics workspace extends retention beyond the built-in period and supports KQL queries.

Question 21Secure identity and access

A group must be able to read only blobs that carry the tag Project=Contoso. What should be added to the group's role assignment on the storage account?

  1. A deny assignment at the resource group
  2. A condition using blob index tags Correct answer.
  3. A Conditional Access policy
  4. A read-only resource lock

Explanation

Azure RBAC role assignment conditions implement attribute-based access control, and blob index tags are a supported attribute for storage data actions. The condition filters the permissions granted by the role assignment so unmatched blobs are not readable.

Question 22Secure identity and access

Contoso wants to accept multi-factor authentication claims from partner-tenant users so those users are not prompted again. Which part of the cross-tenant access policy should be configured?

  1. Outbound access settings
  2. Tenant restrictions
  3. Inbound trust settings Correct answer.
  4. Connected organizations

Explanation

Inbound trust settings let the resource tenant trust MFA, compliant device or hybrid-joined claims issued by the user's home tenant. Outbound settings control whether your own users can reach external tenants.

Question 23Secure identity and access

A Conditional Access policy must force users to reauthenticate after eight hours of continuous use of a web application. Which session control provides this?

  1. Persistent browser session
  2. Continuous access evaluation
  3. Sign-in frequency Correct answer.
  4. Application enforced restrictions

Explanation

Sign-in frequency defines the interval after which a user must sign in again, and it can be configured per policy and per application. Persistent browser session instead controls whether cookies survive closing the browser.

Question 24Secure identity and access

A GitHub Actions workflow must authenticate to Azure without storing any secret or certificate. What should be configured on the app registration?

  1. A federated identity credential Correct answer.
  2. A redirect URI registered in the app
  3. A certificate uploaded to Azure Key Vault
  4. A client secret stored in the repository

Explanation

Workload identity federation uses a federated identity credential to trust tokens issued by an external identity provider such as GitHub, so no credential material is stored. The workflow exchanges its OpenID Connect token for an Azure access token at runtime.

Question 25Secure identity and access

Which statement about Azure deny assignments is accurate?

  1. They take precedence over role assignments Correct answer.
  2. They expire automatically after 90 days
  3. Subscription Owners create them in the portal
  4. They apply only to data plane operations

Explanation

Deny assignments are created by Azure platform services such as managed applications and blueprint deployments, and they block the listed actions regardless of any role assignment, including Owner. Customers cannot author deny assignments directly.

Question 26Secure identity and access

A virtual machine is configured with a system-assigned managed identity. The virtual machine is deleted and then recreated from the same template. What happens to the identity?

  1. The identity is inherited by the replacement resource from the resource group.
  2. The original identity and its object ID are reused automatically.
  3. The identity is retained for 30 days and then reattached.
  4. A new identity with a new object ID is created. Correct answer.

Explanation

A system-assigned managed identity is created in Microsoft Entra ID with the lifetime of the Azure resource it is enabled on. When the resource is deleted the identity is deleted, so recreating the resource produces a brand-new identity with a different object ID, and any role assignments made to the old identity must be recreated.

Question 27Secure identity and access

A user is assigned the Reader role at a management group scope. Which resources does the assignment apply to?

  1. Only the management group object itself.
  2. Only the resources that the user owns in each subscription.
  3. All subscriptions in the management group and the resources beneath them. Correct answer.
  4. Only the subscriptions that were created after the role assignment was made.

Explanation

Azure RBAC assignments are inherited downward through the scope hierarchy: management group, subscription, resource group, then resource. An assignment at a management group therefore grants the role on every subscription inside that group and on all resource groups and resources within those subscriptions.

Question 28Secure identity and access

Which statement best distinguishes Microsoft Entra roles from Azure RBAC roles?

  1. Entra roles control access to Azure resources, whereas Azure RBAC roles control directory objects.
  2. Entra roles can be assigned only to users, whereas Azure RBAC roles can be assigned only to groups.
  3. Entra roles apply only at the tenant root, whereas Azure RBAC roles apply only to subscriptions.
  4. Entra roles govern directory objects, whereas Azure RBAC roles govern Azure resources. Correct answer.

Explanation

Microsoft Entra roles manage directory-level objects such as users, groups, applications and administrative role assignments, while Azure RBAC roles manage control-plane and data-plane access to Azure resources such as storage accounts and virtual machines. The two systems are independent and each principal may hold assignments in both.

Question 29Secure identity and access

In Privileged Identity Management, what does an eligible role assignment mean for a user?

  1. The role can be activated by any member of the tenant without approval.
  2. The role permissions are active continuously until an administrator removes them.
  3. The user must activate the role before its permissions take effect. Correct answer.
  4. The assignment can be used only while a scheduled access review is open.

Explanation

An eligible assignment makes a user a candidate for a role without granting its permissions yet; the user activates the role when needed, which can require justification, approval or multifactor authentication. An active assignment, by contrast, grants the permissions immediately until it expires or is removed.

Question 30Secure identity and access

An administrator enables security defaults in a tenant. What is the resulting behaviour?

  1. Guest users are blocked from signing in until they register a hardware token.
  2. All users must register for multifactor authentication, and legacy authentication protocols are blocked. Correct answer.
  3. Conditional Access policies are generated automatically for every enterprise application.
  4. Every user must sign in with a phishing-resistant credential such as a FIDO2 security key.

Explanation

Security defaults are a baseline configuration that requires all users to register for and use Microsoft Entra multifactor authentication and blocks legacy authentication clients such as IMAP and POP. They are a fixed set of controls and cannot be customized, so they are typically replaced by Conditional Access in mature tenants.

Question 31Secure identity and access

An external user redeems an invitation sent through Microsoft Entra B2B collaboration. Where is the guest user object created?

  1. In a new tenant that is created specifically for the collaboration.
  2. In the tenant that sent the invitation. Correct answer.
  3. In the on-premises Active Directory of the inviting organization.
  4. In the home tenant of the external user only.

Explanation

B2B collaboration creates a guest user object in the resource tenant that sends the invitation, and the guest authenticates with credentials from their own home tenant or identity provider. The home tenant of the guest does not receive an object, and no separate tenant is provisioned.

Question 32Secure identity and access

A key vault is configured to use Azure RBAC for data-plane authorization. Which built-in role allows a principal to read secret values?

  1. Key Vault Certificates Officer
  2. Key Vault Secrets User Correct answer.
  3. Key Vault Reader
  4. Key Vault Contributor

Explanation

Key Vault Secrets User grants read access to secret contents, which is the data-plane permission needed to retrieve a secret value. Management roles such as Key Vault Contributor control the vault resource itself but do not grant access to the data inside it.

Question 33Secure identity and access

A Conditional Access policy is set to Report-only mode. What happens to sign-ins that match the policy?

  1. The user is prompted to justify access before being allowed to continue.
  2. Access is blocked, and the block is recorded as a report entry.
  3. The policy applies only to guest users until an administrator enables it.
  4. The policy is evaluated and logged, but not enforced. Correct answer.

Explanation

Report-only mode evaluates a policy against real sign-ins and records the outcome in the sign-in logs without applying any grant or session control. It is used to measure the impact of a policy before it is switched to On, and it affects all in-scope users rather than a subset.

Question 34Secure identity and access

A custom Azure RBAC role definition lists Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read in its Actions property. Users assigned the role still cannot read blob contents. What is the reason?

  1. Reading blob contents requires the assignment to be made eligible in PIM.
  2. The role must be assigned at management group scope before blob contents can be read.
  3. The role must also include the wildcard action Microsoft.Storage/* to read data.
  4. Blob content operations must be declared in DataActions, not in Actions. Correct answer.

Explanation

A role definition separates control-plane operations (Actions and NotActions) from data-plane operations (DataActions and NotDataActions). Blob read and write operations act on data inside the storage account and are therefore only effective when listed under DataActions.

Question 35Secure identity and access

Administrators must present a phishing-resistant credential, such as a FIDO2 security key or a certificate-based credential, before they can reach the Azure portal. Which Conditional Access grant control should be configured?

  1. Require device to be marked as compliant
  2. Require authentication strength Correct answer.
  3. Require Microsoft Entra hybrid joined device
  4. Require multifactor authentication

Explanation

Authentication strength is a grant control that references a predefined or custom set of allowed authentication methods; the built-in phishing-resistant MFA strength permits only methods such as FIDO2 and certificate-based authentication. Plain 'Require multifactor authentication' accepts any registered MFA method, including weaker ones.

Question 36Secure identity and access

Microsoft Entra ID Protection rates a user account as high risk because leaked credentials were found. A user risk policy is configured with a High threshold. What must the user complete to remediate the risk?

  1. Sign in again and change the password. Correct answer.
  2. Register the device in Microsoft Entra ID.
  3. Accept the tenant's terms of use.
  4. Complete Microsoft Entra multifactor authentication.

Explanation

A user risk policy responds to user risk detections such as leaked credentials, and the supported remediation is a secure password change performed after signing in. Sign-in risk policies, by contrast, are remediated by completing multifactor authentication.

Question 37Secure identity and access

An administrator wants each user to verify with two different contact methods before self-service password reset completes. Which setting controls this requirement?

  1. The 'Number of methods required to reset' setting Correct answer.
  2. The custom banned password list in Microsoft Entra Password Protection
  3. The sign-in frequency control in a Conditional Access policy
  4. The registration campaign settings for Microsoft Authenticator

Explanation

The number of methods required to reset is a self-service password reset policy setting that determines whether one or two verification methods must be satisfied before the password can be changed. Sign-in frequency and password protection settings govern different behaviours and do not affect reset verification.

Question 38Secure identity and access

A background application must read every user's mailbox in the tenant without any signed-in user present. Which permission configuration is required?

  1. A delegated Mail.Read permission consented to by each user.
  2. An application Mail.Read permission granted with tenant-wide admin consent. Correct answer.
  3. A delegated Mail.ReadBasic permission granted on behalf of every mailbox owner.
  4. An application Mail.ReadBasic permission consented to by each individual user.

Explanation

Background services that run without a signed-in user use application permissions, which act with the identity of the application itself and always require tenant-wide administrator consent. Delegated permissions act on behalf of a signed-in user and cannot cover all mailboxes from a daemon process.

Question 39Secure identity and access

Users are synchronized from on-premises Active Directory, and they must be able to reset their password in the cloud with the new password also taking effect on-premises. What must be enabled?

  1. Password writeback in Microsoft Entra Connect Correct answer.
  2. Password hash synchronization in Microsoft Entra Connect
  3. Seamless single sign-on in Microsoft Entra Connect
  4. Pass-through authentication with a staging server

Explanation

Password writeback sends password changes made in the cloud, including self-service password reset, back to on-premises Active Directory. Password hash synchronization and pass-through authentication only affect how sign-in is validated and do not return changes to the local directory.

Question 40Secure identity and access

Employees and partners must be able to request a bundle of groups, applications and SharePoint sites, with an approver and automatic expiry. What should be created?

  1. A Conditional Access policy with a session control
  2. A dynamic membership group with an attribute rule
  3. An access package in entitlement management Correct answer.
  4. A recurring access review for each resource

Explanation

An access package groups the resources that a user needs into a single requestable unit and supports approval workflows, assignment expiry and periodic access reviews. Dynamic groups and access reviews manage membership or recertification but do not provide a request-and-approve catalogue across multiple resource types.

Question 41Secure identity and access

Which Privileged Identity Management role setting determines how long a user can keep a role active after activating it?

  1. Require justification on activation
  2. Maximum activation duration Correct answer.
  3. Require approval to activate
  4. Require multifactor authentication on activation

Explanation

Maximum activation duration caps the length of time that an activated assignment stays active before the user must activate the role again. The other settings add controls to the activation request itself rather than limiting how long the resulting permissions last.

Question 42Secure identity and access

A Conditional Access policy must block legacy authentication protocols such as IMAP and POP. Which condition targets these clients?

  1. The locations condition with 'Any location' selected
  2. The authentication strength condition with multifactor authentication selected
  3. The client apps condition set to Exchange ActiveSync and other clients Correct answer.
  4. The device state condition with 'Hybrid Azure AD joined' selected

Explanation

Legacy protocols are identified through the client apps condition, where 'Exchange ActiveSync clients' and 'Other clients' represent clients that cannot perform modern authentication. A policy that blocks those client types with no other conditions is the standard way to eliminate legacy authentication.

Question 43Secure identity and access

Remote users must reach an on-premises web application through Microsoft Entra pre-authentication without using a VPN. What should be configured?

  1. Microsoft Entra application proxy Correct answer.
  2. A private endpoint for the application
  3. A network security group rule allowing inbound HTTPS
  4. A site-to-site VPN gateway

Explanation

Application proxy publishes an on-premises web application through the Microsoft Entra service using a connector, so users authenticate to Microsoft Entra ID first and Conditional Access policies can be applied. Private endpoints and VPN gateways provide network connectivity only and do not add identity-based pre-authentication.

Question 44Secure identity and access

A user's access must be revoked within minutes of the account being disabled or the password being changed, without waiting for the token to expire. Which capability provides this?

  1. A sign-in frequency of one hour
  2. A persistent browser session control
  3. Continuous access evaluation Correct answer.
  4. Configurable token lifetime policies

Explanation

Continuous access evaluation lets resource providers such as Exchange Online and SharePoint react to critical events, including account disablement and password changes, and revoke or challenge tokens in near real time. Token lifetime policies shorten the window but still leave a period in which a stolen token remains usable.

Question 45Secure identity and access

Which Microsoft Entra role is required to create role assignments for other administrators, including assignments to the Global Administrator role?

  1. Privileged Role Administrator Correct answer.
  2. Global Reader
  3. User Administrator
  4. Application Administrator

Explanation

Privileged Role Administrator can manage role assignments and the settings of Privileged Identity Management, including granting administrative roles to other principals. User Administrator manages users and limited password tasks, and Global Reader is a read-only role.

Question 46Secure identity and access

A security team wants members to obtain membership in a role-assignable group only after approval, for a limited time, and with an audit trail. Membership in the group itself is what grants the access. What should be configured?

  1. Privileged Identity Management for Groups with eligible membership Correct answer.
  2. An access review of the group's owners every quarter
  3. A dynamic group with a rule based on the department attribute
  4. A Conditional Access policy that requires group membership

Explanation

Privileged Identity Management for Groups lets group membership or ownership be assigned as eligible so that a user activates it on demand, subject to approval, justification and a maximum duration, with activation history recorded. This provides just-in-time membership for role-assignable groups without standing access.

Question 47Secure identity and access

A service principal authenticates with the client credentials flow. A Conditional Access policy must block it when it is used from outside approved countries. What must the policy target?

  1. All cloud apps, with a device platform condition
  2. The enterprise application's sign-in logs only
  3. Workload identities, with a location condition Correct answer.
  4. The user accounts that own the application registration

Explanation

Conditional Access for workload identities targets service principals directly rather than the users who own them, and a location condition is one of the supported controls for this scenario. Device-based conditions cannot apply because a daemon has no device context.

Question 48Secure identity and access

Two organizations collaborate in Teams shared channels and do not want guest accounts created in either directory. Which capability supports this?

  1. External collaboration settings limited to the partner domain
  2. Guest self-service sign-up through a custom user flow
  3. Cross-tenant synchronization of user objects
  4. B2B direct connect configured in cross-tenant access settings Correct answer.

Explanation

B2B direct connect establishes a mutual trust between two tenants so that users can access shared channels with their own home-tenant credentials, and no guest object is created in the other directory. Cross-tenant access settings define the inbound and outbound trust and any policy applied to that collaboration.

Question 49Secure identity and access

An Azure RBAC role assignment condition must grant access based on a value defined on the user object, such as a department, that is not stored in Azure resource tags. What should be used?

  1. Resource tags on the target storage account
  2. A dynamic group membership rule alone
  3. Custom security attributes Correct answer.
  4. An Azure Policy definition with a deny effect

Explanation

Role assignment conditions can compare resource attributes against attributes of the principal, and custom security attributes defined in Microsoft Entra ID supply those principal attributes. Resource tags describe the target resource only and cannot express a property of the requesting user.

Question 50Secure identity and access

A second Microsoft Entra Connect server is installed in staging mode. What is its behaviour?

  1. It imports and synchronizes but never exports to Microsoft Entra ID. Correct answer.
  2. It actively exports changes to Microsoft Entra ID alongside the primary server.
  3. It replaces the primary server automatically after 24 hours of operation.
  4. It synchronizes only password hashes and no other directory objects.

Explanation

A server in staging mode runs the full import and synchronization cycle so its results can be inspected, but export to Microsoft Entra ID is disabled. This allows an administrator to validate a replacement or configuration change before promoting the server to active.