You have an Azure subscription.
You need to use Microsoft Entra Permissions Management to automatically monitor permissions and create and implement right-size roles. The solution must follow the principle of least privilege.
Which role should you assign to the service principal of Permissions Management?
A. User Access Administrator
B. Contributor
C. Reader
D. Owner
Show Answer
Correct Answer: A
Explanation: Microsoft Entra Permissions Management must be able to analyze existing role assignments and automatically create, adjust, and assign right-sized roles. That requires permissions to manage access (RBAC) but not to create or modify Azure resources themselves. The User Access Administrator role can create and assign roles and manage permissions while adhering to the principle of least privilege. Contributor cannot manage role assignments, Reader is insufficient, and Owner grants excessive privileges.
Question 136
HOTSPOT
-
You have an Azure subscription named Sub1 that contains a storage account named storage1.
You need to deploy two apps named App1 and App2 that will have the following configurations:
• App1 will be deployed as a registered app in Sub1.
• App1 will access storage1 by using Microsoft Entra authentication.
• App2 will access storage1 by using a single Microsoft Entra identity.
• App2 be hosted on two new virtual machines named VM1 and VM2.
The solution must minimize administrative effort.
Which type of identity will each app use to access storage1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: App1: Service principal
App2: User-assigned managed identity
Explanation: App1 is deployed as a registered app, which authenticates to Azure resources through its service principal in Microsoft Entra ID. Managed identities apply only to Azure resources, not app registrations.
App2 runs on two VMs and must use a single shared identity to access storage1. A user-assigned managed identity can be attached to both VM1 and VM2, minimizing administrative effort compared to separate identities.
Question 137
You have a Microsoft 365 subscription.
You plan to deploy an app named App1 that will have the following configurations:
• Will be registered in Microsoft Entra
• Will access the signed-in user's Microsoft Outlook calendar by using the Microsoft Graph API
You need to ensure that App1 can access Microsoft Graph.
What should you use?
A. application permissions
B. delegated permissions
C. a custom role-based access control (RBAC) role
D. a built-in role-based access control (RBAC) role
Show Answer
Correct Answer: B
Explanation: App1 will access Microsoft Graph on behalf of a signed-in user to read that user's Outlook calendar. This is a delegated access scenario, which requires delegated permissions. Application permissions are used only for app-only access without a signed-in user, and RBAC roles are not how Graph API access is granted.
Question 138
You have a Microsoft 365 E5 subscription that contains a user named User1. User1 is eligible for the Application Administrator role.
User1 needs to configure a new connector group for an application proxy.
What should you use to activate the role for User1?
A. the Microsoft 365 Defender portal
B. the Microsoft 365 admin center
C. the Microsoft Intune admin center
D. the Azure Active Directory admin center
Show Answer
Correct Answer: D
Explanation: User1 is eligible for the Application Administrator role, which means the role must be activated through Privileged Identity Management (PIM). PIM role activation is performed in the Azure Active Directory admin center (now called the Microsoft Entra admin center) under My roles. Other portals do not support activating Entra ID roles via PIM.
Question 139
You have a Microsoft 365 tenant.
In Microsoft Entra ID, you configure the terms of use.
You need to ensure that only users who accept the terms of use can access the resources in the tenant. Other users must be denied access.
What should you configure?
A. Terms and conditions in Microsoft Intune
B. an access policy in Microsoft Defender for Cloud Apps
C. a conditional access policy in Microsoft Entra ID
D. a compliance policy in Microsoft Intune
Show Answer
Correct Answer: C
Explanation: Microsoft Entra ID Terms of Use are enforced through Conditional Access. By configuring a Conditional Access policy that requires acceptance of the configured Terms of Use, only users who accept them are granted access to tenant resources, while users who do not accept are denied. Other options (Intune policies or Defender for Cloud Apps) do not enforce tenant-wide access based on Terms of Use acceptance.
Question 140
You have an Azure subscription that contains a storage account named storage1 and a web app named WebApp1. WebApp1 uses a system-assigned managed identity.
You need to ensure that WebApp1 can read and write files to storage1 by using the system-assigned managed identity.
What should you configure for storage1 in the Azure portal?
A. data protection
B. a shared access signature (SAS)
C. the Access control (IAM) settings
D. the File share settings
E. access keys
Show Answer
Correct Answer: C
Explanation: To allow WebApp1 to access Azure Storage using its system-assigned managed identity, you must grant permissions via Azure RBAC. This is done in the storage account’s Access control (IAM) settings, where you assign roles such as Storage Blob Data Reader or Storage Blob Data Contributor to the managed identity. SAS tokens and access keys are not used with managed identities, and other options do not control identity-based access.
Question 141
You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft 365 group named Group1.
You need to ensure that the members of Group1 can access Site1 for 90 days. The solution must minimize administrative effort.
What should you use?
A. an access package
B. an access review
C. a lifecycle workflow
D. a Conditional Access policy
Show Answer
Correct Answer: A
Explanation: An access package in Microsoft Entra Identity Governance lets you grant time-bound access to resources such as SharePoint Online sites and Microsoft 365 groups. You can configure the access to automatically expire after 90 days, which meets the requirement and minimizes ongoing administrative effort. Access reviews only evaluate existing access, lifecycle workflows manage user lifecycle events, and Conditional Access does not provide time-limited resource access.
Question 143
DRAG DROP
-
You have an Azure subscription that contains the resources shown in the following table.
The subscription uses Privileged Identity Management (PIM).
You need to configure the following access controls by using PIM:
• Ensure that User1 can read and update Secret1.
• Ensure that User2 can read the contents of the secrets stored in Vault2.
The solution must follow the principle of least privilege.
Which authorization method should you use for each user? To answer, drag the appropriate authorization methods to the correct users. Each authorization method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1:
The Key Vault Secrets Officer RBAC role
User2:
The Key Vault Secrets User RBAC role
Explanation: PIM works with Azure RBAC, not legacy Key Vault access policies. User1 must read and update a secret, which requires full secret management permissions without managing vault access, provided by Key Vault Secrets Officer. User2 only needs to read secret contents, which is the least-privileged data-plane role provided by Key Vault Secrets User.
Question 144
You have an Azure subscription that contains a user named User1. The subscription is onboarded to Microsoft Entra Permissions Management.
You need to provide User1 with access to Permissions Management. The solution must meet the following requirements:
• Follow the principle of least privilege.
• Minimize administrative effort.
What should you do first?
A. From the Role/Policy Template subtab of Permissions Management, create a template.
B. From the Microsoft Entra admin center, create a security group.
C. From the My Requests subtab of Permissions Management, create a new request.
D. From the Microsoft Entra admin center, assign a role to User1.
Show Answer
Correct Answer: B
Explanation: Microsoft Entra Permissions Management uses a group-based access model. To follow least privilege and minimize ongoing administrative effort, access is granted by assigning Permissions Management roles to Microsoft Entra security groups, not directly to individual users. Therefore, the first step is to create a security group in the Microsoft Entra admin center, after which the appropriate Permissions Management role can be assigned to the group and User1 added as a member.
Question 147
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains an Azure Cosmos DB database named DB1 and an Azure Kubernetes Service (AKS) cluster named AKS1. AKS1 uses a managed identity.
You need to ensure that AKS1 can access DB1. The solution must meet the following requirements:
• Ensure that AKS1 uses the managed identity to access DB1.
• Follow the principle of least privilege.
Which role should you assign to the managed identity of AKS1?
A. For Sub1, assign the Owner role.
B. For DB1, assign the Azure Cosmos DB Account Reader Role role.
C. For RG1, assign the Azure Cosmos DB Data Reader Role role.
D. For RG1, assign the Reader role.
Show Answer
Correct Answer: C
Explanation: AKS1 must access the data in DB1 using its managed identity. Data access in Azure Cosmos DB requires a data-plane RBAC role. The Azure Cosmos DB Account Reader role (B) only allows reading account metadata and does not permit data access, so it does not meet the requirement. Owner and Reader roles (A, D) grant excessive or irrelevant permissions. The Azure Cosmos DB Data Reader role provides read-only access to the data and is the least-privileged role that satisfies the requirement among the given options, even though the scope (RG1) is broader than ideal.
$19
Get all 397 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
