nerdexam
Microsoft

AZ-500 · Question #399

Hotspot Question You have a hybrid Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1 and the servers shown in the following table. The tenant is linked to…

The correct answer is User1 can map share1 to Server1 by using the access key of storage1. = No; User1 can map share1 to Server1 by using the user's credentials. = Yes; User1 can map share1 to Server2 by using the access key of storage1. = No. The file share share1 on storage1 is configured to use Kerberos for authentication, as indicated by the "Kerberos" option being checked under "Authentication mechanisms" in the "Security protocol settings" exhibit. Additionally, "SMB 3.1.1" is enabled, which is compatible with…

Submitted by olafpl· Mar 6, 2026Secure compute, storage, and databases

Question

Hotspot Question You have a hybrid Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1 and the servers shown in the following table. The tenant is linked to an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1. User1 is assigned the Storage File Data SMB Share Contributor role for storage1. The Security protocol settings for the file shares of storage1 are configured as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #399 exhibit 1
AZ-500 question #399 exhibit 2

Answer Area

  • User1 can map share1 to Server1 by using the access key of storage1.No
  • User1 can map share1 to Server1 by using the user's credentials.Yes
  • User1 can map share1 to Server2 by using the access key of storage1.No

Explanation

The file share share1 on storage1 is configured to use Kerberos for authentication, as indicated by the "Kerberos" option being checked under "Authentication mechanisms" in the "Security protocol settings" exhibit. Additionally, "SMB 3.1.1" is enabled, which is compatible with Kerberos.

  1. User1 can map share1 to Server1 by using the access key of storage1. => No Since Kerberos authentication is enabled for the file share and Server1 is domain-joined, identity-based authentication using user credentials is the intended method. The official explanation confirms, "Kerberos uses user's credentials, not access keys." Using an access key would bypass this identity-based authentication.

  2. User1 can map share1 to Server1 by using the user's credentials. => Yes Server1 is a domain-joined machine, and the file share is configured for Kerberos authentication. User1 has the Storage File Data SMB Share Contributor role, which provides the necessary share-level permissions. For Kerberos authentication in a hybrid Azure AD environment, users on domain-joined machines authenticate using their domain (user) credentials. The official explanation states, "Kerberos uses user's credentials."

  3. User1 can map share1 to Server2 by using the access key of storage1. => No This statement follows the same logic as Statement 1. The file share is configured for Kerberos authentication, and Server2 is also a domain-joined machine. Access keys are not used when Kerberos authentication is the configured method for identity-based access from domain-joined servers.

Topics

#Azure Files SMB#Azure AD Authentication#RBAC#Hybrid Identity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice