AZ-500 Practice Test

Sample AZ-500 Practice Questions

10 real questions from the free AZ-500bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. A developer has registered a multi-tenant SaaS application in their Contoso tenant. Users from the Fabrikam tenant attempt to sign in for the first time. What must occur before the application can access Fabrikam users' data?

   • A. Admin consent in the Contoso tenant can be extended to cover Fabrikam users if a cross-tenant access policy with B2B direct connect is configured to trust Contoso's consent decisions for the application
   • B. Fabrikam users must individually consent to the requested permissions at sign-in, or a Fabrikam administrator must grant tenant-wide admin consent - Contoso's admin consent does not extend to the Fabrikam tenant
   • C. Fabrikam users are redirected to the Contoso tenant for authentication and any consent is recorded against Contoso's service principal, so that consent record then applies to additional external tenants using the app
   • D. Because the application is published in the Microsoft Entra app gallery, Fabrikam users inherit pre-approved permission scopes and can sign in without ever seeing an individual consent prompt for the app
   Show answer

   Correct answer: B

   In multi-tenant applications, consent is tenant-scoped - Contoso's admin consent applies only within the Contoso tenant. The first time Fabrikam users sign in they see a consent prompt for the application's requested permissions, or a Fabrikam administrator can grant tenant-wide admin consent to pre-approve it for all Fabrikam users (option B). Option A is wrong: cross-tenant access policies govern B2B guest identity trust, not admin-consent propagation. Option C is wrong: multi-tenant sign-ins authenticate users against their home tenant (Fabrikam), so consent is recorded per home tenant, not reused from Contoso. Option D is wrong: app gallery listing does not grant automatic consent in external tenants.

2. 2. Which built-in Microsoft Entra Privileged Identity Management capability proactively alerts security administrators when the number of users assigned the Global Administrator role grows beyond the level the organization considers safe?

   • A. Configure the built-in PIM 'There are too many Global Administrators' alert in the Microsoft Entra roles Alerts settings, setting a minimum Global Administrator count and a percentage threshold; PIM raises the alert to the configured recipients when both thresholds are exceeded.
   • B. Configure a Conditional Access policy on the role activation flow to block activations outside business hours or approved IP ranges; this controls activation frequency and location but does not monitor or alert on the number of Global Administrators assigned.
   • C. Configure just-in-time access with a maximum activation duration in PIM role settings so role access expires automatically after the set window; time-bounded activation controls how long a role is active but does not track or alert on the number of users assigned to the role.
   • D. Configure a Microsoft Sentinel scheduled analytics rule with a KQL query against the AuditLogs table for role-assignment operations; this reports historical assignment events with ingestion delay rather than the built-in PIM assignment-count alert.
   Show answer

   Correct answer: A

   Microsoft Entra PIM includes a built-in 'There are too many Global Administrators' alert (option A), configured under Microsoft Entra roles > Alerts > Settings. It defines a minimum Global Administrator count (2-100) and a percentage threshold, and PIM raises the alert when both the count and percentage criteria are exceeded - flagging over-provisioning of the highest-privilege role. Option B is wrong: Conditional Access on activation governs who can activate and under what conditions, not the count of assigned Global Administrators. Option C is wrong: activation-duration limits control how long a role stays active, not the number of assignees. Option D is wrong: a Sentinel KQL query over AuditLogs counts historical assignment operations with ingestion delay, not the current state the built-in PIM alert monitors. (PIM has no 'too few eligible administrators' alert.)

3. 3. A developer is deploying an Azure Function that needs access to Key Vault. When the Function App is deleted, the Key Vault access should be automatically revoked without manual cleanup. Which identity type should be assigned to the Function App?

   • A. User-assigned managed identity -- created as a standalone Azure resource that can be shared across multiple services; it persists independently after the Function App is deleted until explicitly removed
   • B. Federated identity credential -- an OIDC-based configuration that allows external workloads such as GitHub Actions or Kubernetes pods to authenticate to Azure without storing secrets
   • C. Application service principal -- a Microsoft Entra application registration with a client secret or certificate that is independent of any Azure resource lifecycle and must be manually decommissioned
   • D. System-assigned managed identity -- enabled directly on the Function App and tied to its lifecycle; when the Function App is deleted, the identity is automatically removed along with any role assignments granted to it
   Show answer

   Correct answer: D

   A system-assigned managed identity is enabled directly on an Azure resource and shares its lifecycle - when the resource is deleted, the identity is automatically deleted along with its associated Microsoft Entra service principal. Any Azure RBAC role assignments (such as Key Vault Secrets User) granted to the system-assigned identity become orphaned entries that no longer grant access to any principal. A user-assigned managed identity is a standalone Azure resource that persists after the Function App is deleted and must be manually removed, along with any Key Vault access policies or RBAC role assignments it holds.

4. 4. A financial services company needs stricter Conditional Access policies for high-risk applications like treasury management. Which feature enables this granular application targeting?

   • A. Create separate Conditional Access policies targeting specific cloud applications - require compliant device and low sign-in risk for high-risk apps like treasury management, while allowing MFA-only for less sensitive applications
   • B. Enable Microsoft Entra Continuous Access Evaluation (CAE) for the treasury management application - CAE enforces real-time policy changes including location and risk updates mid-session without waiting for token expiration
   • C. Use Microsoft Entra Application Proxy with a custom authentication extension to apply stricter pre-authentication requirements for the treasury management application before requests reach the backend service
   • D. Apply one global Conditional Access policy across the cloud apps with no application-specific filtering - this simplifies policy management and applies consistent authentication requirements regardless of application sensitivity
   Show answer

   Correct answer: A

   Conditional Access policies target specific cloud applications (A) in the 'Cloud apps or actions' condition, enabling different controls per app - compliant device and low sign-in risk for treasury management versus MFA-only for less sensitive apps. Option B describes Continuous Access Evaluation (CAE), which enforces real-time policy updates mid-session but does not provide per-application requirement differences at sign-in time. Option C describes Application Proxy for on-premises apps; it does not replace per-app Conditional Access targeting for cloud-hosted applications. Option D applies uniform controls to all apps, defeating the requirement for differentiated protection for high-risk applications.

5. 5. A security engineer is creating a custom RBAC role that allows starting and stopping Azure VMs but not deleting them. Which property in the role definition JSON should contain 'Microsoft.Compute/virtualMachines/start/action' and 'Microsoft.Compute/virtualMachines/deallocate/action'?

   • A. The DataActions array - starting and stopping VMs modifies compute resource state on the data plane; VM lifecycle operations such as start and deallocate should be listed in DataActions to separate them from management plane operations in Actions
   • B. The AssignableScopes array - defining the operations at management group level in AssignableScopes lets the role be used for VM management across subscriptions without explicitly listing each subscription scope
   • C. The NotActions array - listing the operations in NotActions allows them to be performed when this role is combined with another role that has matching entries, creating an additive exception to the base set of denied operations
   • D. The Actions array - contains the allowed management-plane operations; control-plane permissions such as Microsoft.Compute/virtualMachines/start/action and deallocate/action are listed here, which permits starting and stopping the VMs
   Show answer

   Correct answer: D

   The Actions array defines allowed management-plane operations (option D). Microsoft.Compute/virtualMachines/start/action and deallocate/action are management-plane operations that belong in Actions. Option A is wrong: DataActions contains data-plane operations (e.g., storage blob read/write) - VM lifecycle operations are management plane, not data plane. Option B is wrong: AssignableScopes defines where the role can be assigned (subscriptions, resource groups), not which operations are permitted. Option C is wrong: NotActions excludes operations from the Actions set - listing the desired operations there would subtract them, not permit them.