Four exam-style questions I wrote this week (PIM, Key Vault, storage, NSG), answers hidden, explanations in plain words.
How to use these: read the question, pick your answer before you open Answer, and write it down (or in the comments). Then check the "why not the others" part even if you got it right: that is where the exam traps live. Every scenario, name and number is made up by me; only the question formats follow the real exam.
Table of contents
- Q001: Admin role only on request, max 4 hours, with approval
- Q002: A VM reads a Key Vault secret without keeping a secret
- Q003: Stop anonymous blob reads, now and later
- Q004: NSG rules with application security groups
- Cheat sheet
- Coming next
Q001: Admin role only on request, max 4 hours, with approval
Identity and access · Single choice · standalone page
Your helpdesk lead, Mai, sometimes needs the User Administrator role to fix accounts. Your security team says: "Fine, but only when she asks for it, for at most 4 hours, and someone has to say yes first."
What should you configure?
- A. A permanent active assignment of User Administrator, plus a Conditional Access policy that requires MFA
- B. A Privileged Identity Management (PIM) eligible assignment of User Administrator, with role settings: activation maximum duration 4 hours and require approval to activate
- C. An access review on the User Administrator role that runs every 4 hours
- D. An administrative unit that contains Mai's account
Answer
B. "Eligible" means Mai does not hold the role until she activates it. In the PIM role settings, the activation maximum duration can be anything from 1 to 24 hours (so 4 is fine), and "Require approval to activate" makes at least one approver say yes first.
Why not the others:
- A gives her the role 24/7. MFA proves it is really Mai, it does not make the role go away after 4 hours.
- C checks who has access, after the fact. An access review every 4 hours would mostly annoy the reviewers.
- D limits which users she can manage, not when she can manage them.
Source: Configure Microsoft Entra role settings in Privileged Identity Management
Q002: A VM reads a Key Vault secret without keeping a secret
Identity and access · Yes/No series ("Does this meet the goal?") · standalone page
Yes/No series: same scenario, a different solution each time. Some scenarios have several right solutions, some have none.
An app on the Azure VM vm-lab-01 must read a database password stored in the key vault kv-lab-01. The vault uses the Azure RBAC permission model. Goal: no password, key or certificate is stored in the app code or on the VM.
Solution: You enable a system-assigned managed identity on vm-lab-01 and assign it the Key Vault Secrets User role on kv-lab-01.
Does this meet the goal?
- A. Yes
- B. No
Answer
A. Yes. The VM gets its own identity in Microsoft Entra ID, so the app asks Azure for a token instead of keeping a secret in a config file. Key Vault Secrets User can read secret contents, and it works here because the vault uses the Azure RBAC permission model.
Other solutions you might see in the same series:
- "Store a client secret for an app registration in
appsettings.json" → No. That is a secret sitting on the VM, the exact thing the goal forbids. - "Assign the managed identity Key Vault Reader" → No. Reader sees the vault and the names of its secrets (metadata), but it cannot read the secret values. Close, but no password for you.
Source: Provide access to Key Vault keys, certificates, and secrets with Azure role-based access control
Q003: Stop anonymous blob reads, now and later
Compute, storage and databases · Hot area · standalone page
Someone set one container in the storage account stlabdata01 to "Container (anonymous read access)". Your boss wants no anonymous reads in any container of this account, now and later, even if someone changes a container setting again next week.
Pick the right value for each line:
| Where | Setting | Your choice |
|---|---|---|
Storage account stlabdata01 › Settings › Configuration |
Allow Blob anonymous access | ▢ Enabled ▢ Disabled |
| Each container | Anonymous access level | ▢ Must be changed to Private one by one ▢ Nothing more to do |
Answer
Disabled / Nothing more to do. The account setting (property AllowBlobPublicAccess) overrides the container settings: once it is off, containers that were set to anonymous access are no longer reachable anonymously. Flipping containers to Private one by one is nice tidying, but it is not what stops the leak, and the next person can flip a container right back.
Why not the other values: Enabled leaves every container in charge of its own fate. Changing containers one by one only fixes today, not "later".
Bonus: to do this for every storage account at once, use the built-in Azure Policy "Storage account public access should be disallowed" (Audit or Deny). One gotcha: a static website's $web container stays public no matter what, because that is its job.
Sources: Remediate anonymous read access to blob data · Azure Policy built-in definitions for Azure Storage
Q004: NSG rules with application security groups
Networking · Drag and drop · standalone page
The virtual network vnet-shop has one subnet with the network security group nsg-shop attached. The VMs web01 and web02 are in the application security group asg-web. The VMs api01 and api02 are in asg-api. Everything is in the same virtual network.
You need to meet these rules:
- People on the internet can reach the web VMs on HTTPS.
- Only the web VMs can reach the API VMs, on TCP 8443.
- Nothing else inside the virtual network can reach the API VMs. (Yes, that includes the test VM someone "temporarily" created in March.)
Drag the right value into each numbered box. Each value can be used once, more than once, or not at all.
Values: Internet · VirtualNetwork · AzureLoadBalancer · asg-web · asg-api · 443 · 8443 · 3389
Inbound rules on nsg-shop:
| Priority | Name | Source | Destination | Port | Action |
|---|---|---|---|---|---|
| 100 | allow-https-web | [1] | [2] | 443 | Allow |
| 200 | allow-web-to-api | [3] | [4] | [5] | Allow |
| 300 | deny-vnet-to-api | [6] | asg-api | Any | Deny |
Answer
[1] Internet · [2] asg-web · [3] asg-web · [4] asg-api · [5] 8443 · [6] VirtualNetwork
Application security groups let you write rules against "the web VMs" instead of a list of IP addresses, and they work as both source and destination. Rule 300 is the one people forget: the default rule AllowVNetInBound (priority 65000) lets every machine in the virtual network talk to every other one. You cannot delete default rules, but a custom rule with a lower number wins. Rules are checked from the lowest number up and stop at the first match, so the web VMs still get in through rule 200 before rule 300 says no to everyone else.
Why not the other values:
- AzureLoadBalancer in [6] would block the load balancer health probes, not your test VM. Your API would go "unhealthy" and you would get a very confusing afternoon.
- VirtualNetwork in [3] would let any VM in the network call the API, which breaks rule 2.
- 443 in [5] or 3389 anywhere: wrong port. Nobody asked for RDP from anywhere.
Gotcha: all network interfaces in one application security group must be in the same virtual network, and when a rule uses an ASG as both source and destination, both groups must be in that same virtual network.
Sources: Application security groups · Network security groups overview
Cheat sheet
The same four ideas in plain words, for the manager who asks "so what?". Share it with them.
Coming next
Monday and Tuesday bring a SAS question for storage accounts with key access switched off, and a just-in-time RDP question for Defender for Cloud. All questions live in the AZ-500 practice folder.
Got one wrong? Good. That is one fewer surprise in the exam room. Drop your answers in the comments.
Top comments (2)
when you enable PIM for a key vault admin, do you script the activation to sidestep the default hour delay or just approve manually during practice?
There's no hour delay, activation takes seconds to minutes. What slows it is approval, which you can't script around, or an old sign-in token, which a re-login fixes. In the lab, I keep approval on and approve from a second account when practicing the exam flow. 😁