CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Access Control in Azure: A Walkthrough of the AZ-500 Exam Question
Learn how to tackle Azure access control questions. We break down a specific AZ-500 exam question to help you master user attribute-based access.
Candidates often trip on questions related to access controls in Azure. This is critical for the AZ-500 exam. Knowing the right tools for user access can make or break your score.
The question
A company has recently migrated its applications to Azure. They want to ensure that only specific users can access certain resources. What should the Azure Security Engineer implement to control access based on user attributes?
- A. Azure Role-Based Access Control (RBAC)
- B. Azure Active Directory (Azure AD) Conditional Access
- C. Azure AD Privileged Identity Management (PIM)
- D. Network Security Groups (NSGs)
Think before you scroll
Consider how each option relates to controlling access based on specific user attributes. The question emphasizes user attributes, which will guide your choice.
The answer
The correct option is B. Azure Active Directory (Azure AD) Conditional Access. This feature allows you to enforce access controls based on user attributes like location and device state, making it the best fit for the scenario presented.
Why the other options lose
- A. Azure Role-Based Access Control (RBAC): While RBAC is essential for managing permissions at the resource level, it does not consider specific user attributes for access control. It assigns roles based on a user’s identity but lacks the granularity of attribute-based conditions.
- C. Azure AD Privileged Identity Management (PIM): PIM is focused on just-in-time access for users with privileged roles. It does not control access based on user attributes, making it less suitable for scenarios that require specific user access management.
- D. Network Security Groups (NSGs): NSGs are used to control inbound and outbound traffic at the network level. They do not provide user-based access control, so they are irrelevant to this question’s focus on specific user access.
The concept behind it
The principle behind this question is understanding user attribute-based access control. Azure AD Conditional Access allows security engineers to implement rules that govern access based on specific user details, such as their location or the device they're using. This principle applies broadly across Azure services, reinforcing the need for precise access management.
Exam trap to remember
Remember: for user attribute-based access control, always prioritize Azure AD Conditional Access. It’s your go-to tool for enforcing access based on user-specific conditions.