Manage Identity & Access (Entra ID)
40 practice questions with explanations — 15 free to try
PassNova has 40 Microsoft AZ-500 (Azure Security) practice questions on Manage Identity & Access (Entra ID), each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Manage Identity & Access (Entra ID): example questions & answers
3 worked examples with answers and explanations below. Try 15 Microsoft AZ-500 (Azure Security) questions free in the browser; the full 40-question Manage Identity & Access (Entra ID) bank is part of PassNova Premium.
You need to require all members of the Helpdesk group to use multi-factor authentication only when they sign in from outside the corporate network. Which Microsoft Entra ID feature should you use?
- AA password protection policy
- BSecurity defaults
- CConditional Access policy with a named location condition✓
- DPer-user MFA settings that force a second factor at every single sign-in regardless of where the user is connecting from
Answer: Conditional Access lets you scope MFA to specific conditions such as a named location, so MFA is enforced only when users sign in from outside trusted IP ranges. Security defaults apply MFA broadly and cannot be scoped by location.
A Global Administrator wants to grant a user the ability to elevate to the User Administrator role only when needed, with approval and a time limit. Which Microsoft Entra ID capability provides this?
- AAdministrative units, narrowing a role assignment to certain users or groups but leaving that assignment standing permanently
- BAccess reviews, run periodically so a reviewer confirms access that already exists rather than granting a role on demand
- CPrivileged Identity Management (PIM)✓
- DEntitlement management
Answer: Privileged Identity Management provides just-in-time, time-bound, and approval-based activation of privileged roles, reducing standing access. Access reviews and entitlement management address recertification and package-based access, not on-demand role elevation.
You want an Azure VM to authenticate to Azure Key Vault to retrieve a secret without storing any credentials in code or configuration. What should you configure?
- AA system-assigned managed identity for the VM✓
- BAn app registration with a certificate uploaded to the VM
- CA service principal with a client secret stored in the VM
- DA shared access signature for the Key Vault
Answer: A system-assigned managed identity gives the VM an identity in Microsoft Entra ID whose credentials are managed by Azure, so no secrets are stored in code or config. Key Vault access is then granted to that identity.