Microsoft Azure Security Engineer - AZ-500 Practice Exam

1. 1.Which directory role must a user hold before they can start managing Microsoft Entra roles in Privileged Identity Management?

   • ACompliance Administrator
   • BGlobal AdministratorCorrect answer
   • CPassword Administrator
   • DSecurity Administrator

   Why

   Global Administrator is required to enable and administer Privileged Identity Management for directory roles. Security Administrator can read security settings but cannot take over role management.

2. 2.Which element of a custom Azure role definition determines at which subscriptions or resource groups the role can be granted?

   • ADataActions
   • BActions
   • CNotActions
   • DAssignableScopesCorrect answer

   Why

   AssignableScopes lists the scopes where the definition may be assigned, while Actions and NotActions describe the operations the role permits.

3. 3.What distinguishes an eligible role assignment from an active one in Privileged Identity Management?

   • AAn eligible assignment applies only to Azure resource roles
   • BAn eligible assignment cannot be time bound
   • CAn eligible assignment grants no permissions until it is activatedCorrect answer
   • DAn eligible assignment bypasses multi-factor authentication

   Why

   An eligible assignment grants nothing until the member activates it, which keeps standing privilege out of the directory between the times the role is actually needed.

4. 4.Which two controls can be required on activation of a privileged role in Privileged Identity Management? (Select TWO.)

   • AA network security group rule
   • BA storage account access key
   • CA business justificationCorrect answer
   • DApproval by a designated approverCorrect answer
   • EA user-defined route

   Why

   The role settings can demand approval by a designated approver and a business justification, and both are recorded in the Privileged Identity Management audit history.

5. 5.Which Microsoft Entra feature has role holders periodically confirmed or removed so that privilege does not accumulate unnoticed?

   • AAn Azure Policy initiative
   • BA Conditional Access policy
   • CAn access reviewCorrect answer
   • DA named location

   Why

   An access review asks the reviewer to attest to each assignment on a recurring schedule and can remove members who are not approved.

Practice all 65 questions

Frequently asked questions