Secure identity and access

AZ-500 · 55 questions

• A canal-authority night shift must restart only the virtual machine that opens Lock 7, but last week an operator received rights on the entire subscription. Which Azure RBAC assignment scope still lets that operator restart the VM while following least privilege?
• A harbor-pilot desk must view every tugboat resource in one resource group but must not resize VMs or create role assignments for contractors. Which built-in Azure role matches that view-only job?
• A grain-elevator cooperative wants a security engineer to assign Virtual Machine Contributor at a resource group without making that person a subscription Owner. Which built-in Azure role can create that role assignment?
• A municipal-water lab assigns Backup Contributor at the subscription and then finds the same principal can start backup jobs in every child resource group. How should the team shrink that blast radius while keeping Azure RBAC inheritance behavior accurate?
• A botanical-garden ticketing crew only needs to start and restart VMs in one resource group after an intern with Contributor deleted a public IP. Which assignment best restores least privilege for that crew?
• A ferry-terminal security desk re-creates the same Reader assignment for twelve individual users whenever a seasonal worker starts. What should the desk do instead so membership changes do not require new role assignments?
• A canal-survey team may restart VMs and read metrics but must not create disks or change NICs, and every nearby built-in compute role still includes extra write actions. What should the security engineer do?
• A credit-union vault team needs a custom role that can read blob data inside a storage account but must not change the storage account resource itself. Where should those permission strings be placed in the custom role definition?
• A harbor-radar shop adds Microsoft.Compute/ to Actions and lists several delete operations under NotActions. A reviewer claims that creates a subscription-wide deny. What is the accurate statement about NotActions?
• A regional compost authority created a custom role with AssignableScopes listing only subscription A, then could not assign it in subscription B in the same tenant. Which statement correctly describes AssignableScopes?
• A municipal-records clerk needs to reset passwords and restart a single VM. A teammate tries to add microsoft.directory password actions to an Azure custom role JSON. What should the security engineer do instead?
• A seed-catalog lab tries to delete a custom Azure role definition, but the portal refuses because three resource groups still list it. What must happen before the definition can be removed?
• A night-harbor superintendent should become subscription Owner only while a lock is jammed, not for the entire month. Which PIM assignment type for that Azure resource role fits?
• An automation account’s managed identity needs Contributor on a resource group so a nightly job can resize a scale set. Why should the security engineer avoid an eligible PIM assignment for that identity?
• A canal-lock Owner role is eligible in PIM, and the security engineer wants a second factor plus a typed business reason before activation. Where should those requirements be configured?
• A grain-elevator Owner activation last quarter remained valid until the next calendar day, and a contractor kept rights overnight. Which PIM control limits how long an activated Azure resource role stays effective?
• Three platform engineers still have permanent active Owner on production. Which PIM assignment setting should the security engineer change for that Azure resource role?
• A water-lab admin required approval to activate Contributor at the subscription, then assigned Contributor at a child resource group where activation needed no approver. What explains that behavior?
• Lock operators already signed in with Windows Hello, so requiring MFA on PIM activation never prompts them. How can the engineer enforce a stronger check during Azure resource role activation?
• A small ferry cooperative still on Microsoft Entra security defaults wants per-group MFA exceptions for a vendor. What must the security engineer understand before creating Conditional Access policies?
• Operators reach production through the Azure portal, Azure CLI, and PowerShell, and MFA must cover that management plane. Which Conditional Access cloud app target is appropriate?
• A compost-authority tabletop showed both Global Administrators would be locked out if the sole MFA method vendor failed. What should the security engineer configure for Azure-management MFA enforcement?
• A legacy runbook still enables per-user MFA for fifteen engineers who open the Azure portal. What is the preferred modern enforcement path for MFA to Azure resources?
• Subscription Owners still satisfy MFA with SMS, and a contractor replayed a text. How should the security engineer raise MFA quality for users who manage Azure without turning the item into an authenticator how-to?
• A botanical-garden platform team can still open the Azure portal from a coffee shop with only a password. Which Conditional Access policy shape enforces MFA for Azure management while sparing break-glass accounts?
• Harbor contractors may open a nonproduction Azure subscription only from Intune-compliant laptops, and everyone else must be denied. Which Conditional Access design meets that requirement for Azure cloud resources?
• A credit-union security lead wants Azure portal users to authenticate again every few hours even after MFA already succeeded at sign-in. Which Conditional Access control re-challenges the session on that schedule?
• A water-lab nearly locked operators out of the Azure portal the last time a Conditional Access policy for Azure management went straight to On. What should the security engineer do before enforcing the new policy?
• Grain-elevator engineers may manage Azure only from the plant’s egress IP ranges; traffic from any other network must require MFA and a compliant device or be blocked. Which Conditional Access element expresses that network boundary for Azure portal work?
• A new hire scoped a Conditional Access block for legacy authentication to All cloud apps and accidentally disrupted directory token flows the team still needed. How should Azure management access be targeted instead while keeping emergency accounts usable?
• A ferry-booking SaaS appeared in the tenant and every employee can launch it from My Apps. What should the security engineer configure on that enterprise application so only the booking group can use it?
• A weekend review shows a gallery CRM still holds a tenant-wide Mail.ReadWrite OAuth grant from a pilot last year. What should the security engineer do in this tenant?
• A botanical-garden SaaS has no enterprise-application owners, so every SSO certificate renewal waits on a Global Administrator. What assignment fixes day-to-day ownership of that app’s tenant settings?
• A compost-vendor app must create user accounts in its own directory when staff are assigned in Microsoft Entra ID. Which enterprise-application capability addresses that requirement, as distinct from OAuth permission grants?
• A seasonal ticket-kiosk enterprise application must stop accepting sign-ins this week, but the security engineer must keep the service principal and its grants for a later audit. What action meets both needs?
• A municipal-records team registered an API under App registrations, but a contractor searched only Enterprise applications and reported that the app does not exist. How should the security engineer explain the relationship in this tenant?
• A harbor-radio companion app is a public mobile client, yet its app registration lists only a web redirect URI and treats the app as a confidential client with a client secret. What should the security engineer correct on the registration?
• A grain-elevator API registration still uses a two-year client secret pasted into a Function app setting. What credential approach should the security engineer prefer on the app registration?
• Developers in a water-lab tenant can register new apps and immediately request Microsoft Graph permissions. Which tenant setting should the security engineer tighten so only authorized administrators can create app registrations?
• A ferry kiosk must read only the signed-in clerk’s profile, not every user in the tenant. Which permission type should be added on the app registration?
• A botanical-garden inventory API is called by an internal SPA, and the team plans to reuse User.Read as the only scope. What should the security engineer configure on the inventory app registration instead?
• A compost-tracking app registration lists Directory.ReadWrite.All delegated and Sites.ReadWrite.All application permissions “just in case.” What should the security engineer do?
• A daemon that syncs lock schedules needs application Mail.Send with no signed-in user. What must the security engineer understand when adding that permission on the app registration?
• A clerk tries to sign into a new inventory app that requests Directory.ReadWrite.All, but no usable consent prompt appears for that clerk. What is the most likely consent requirement?
• A harbor-operations API needs every employee to use reviewed scopes without a per-user consent prompt. Which consent action should the security engineer take?
• A water-lab user consented to a random multi-tenant app that then read mail. Which tenant control should the security engineer tighten?
• Developers still need a path to request Graph scopes after user consent is disabled. Which Entra feature should the security engineer enable?
• A multi-tenant ticketing vendor’s app registration lives in the vendor tenant, but the grain elevator must assign Azure RBAC and review grants locally. Where should the security engineer work?
• A lock-scheduling daemon authenticates as a service principal yet still stores a storage account key on disk. What should the security engineer do?
• A compost-lab service principal still has a password credential created three years ago, and nobody can determine who generated it. What should the security engineer do?
• A retired radar integration’s service principal still has Contributor on a production resource group, even though the team says the app registration lives in another tenant. What should the security engineer do first?
• A single water-quality VM must read one storage account, and the team does not want a leftover identity after the VM is decommissioned. Which identity approach should the security engineer enable?
• A canal authority recycles VM scale-set instances weekly but needs the same identity and the same Azure role assignments to survive instance replacement. What should the security engineer create?
• A municipal Function app has a system-assigned managed identity enabled, but blob reads still return 403. What should the security engineer do?
• A harbor-pilot runbook asks for “the password of the VM’s managed identity” so it can be stored next to other secrets. How should the security engineer respond?