AZ-500 Secure compute, storage, and databases Practice Question
Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse network-level restrictions (firewall rules) or token-based access (SAS) with identity-based access control, mistakenly believing that restricting IP ranges or using SAS tokens satisfies the requirement for explicit user permissions, when in fact only identity-based authentication with Microsoft Entra ID provides per-user authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.
Identity-based authentication for Azure Files using Microsoft Entra ID allows you to assign share-level permissions (e.g., Storage File Data SMB Share Contributor) to specific users or groups, ensuring only explicitly authorized identities can access the share. This meets the requirement of restricting access to users with explicit permissions, as opposed to relying on network rules or shared keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a firewall rule to allow only corporate IP ranges.
Why it's wrong here
Firewall restricts network, not user-level access.
- ✗
Use storage account access keys to mount the file share.
Why it's wrong here
Access keys provide full account access, not per-user.
- ✓
Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.
Why this is correct
Identity-based authentication maps users to share permissions.
- ✗
Generate a shared access signature (SAS) with read permissions.
Why it's wrong here
SAS tokens are not tied to specific users.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.