nerdexam
Microsoft

AZ-500 · Question #604

Hotspot Question Your on-premises network contains an Active Directory Domain Services (AD DS) domain and the devices shown in the following table. You have a hybrid Microsoft Entra tenant that…

The correct answer is SMB 2.1 = No; SMB 3.0 = No; SMB 3.1.1 = Yes. This question tests understanding of Azure Files SMB authentication with hybrid identities, specifically how RBAC roles, share-level permissions, and directory/file-level NTFS permissions interact when accessed from domain-joined vs. non-domain-joined devices.

Submitted by lucia.co· Mar 6, 2026Secure compute, storage, and databases

Question

Hotspot Question Your on-premises network contains an Active Directory Domain Services (AD DS) domain and the devices shown in the following table. You have a hybrid Microsoft Entra tenant that contains a synced user named User1. You have an Azure subscription that contains the Azure Files shares shown in the following table. User1 is assigned the Storage File Data SMB Share Contributor role for storage1 and storage2. The Security settings for Share1 are configured as shown in the following exhibit. The Security settings for Share2 are configured as shown in the following exhibit. For each of the following statement, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #604 exhibit 1
AZ-500 question #604 exhibit 2
AZ-500 question #604 exhibit 3
AZ-500 question #604 exhibit 4

Answer Area

  • SMB 2.1No
  • SMB 3.0No
  • SMB 3.1.1Yes

Explanation

This question tests understanding of Azure Files SMB authentication with hybrid identities, specifically how RBAC roles, share-level permissions, and directory/file-level NTFS permissions interact when accessed from domain-joined vs. non-domain-joined devices.

Approach. For Azure Files hybrid access: (1) The device must be domain-joined (either on-premises AD DS or Microsoft Entra joined) to authenticate via Kerberos tickets for SMB access using identity-based authentication. (2) The user needs both the RBAC role (Storage File Data SMB Share Contributor is assigned here) AND sufficient NTFS/share-level permissions on the share. (3) If a device is NOT domain-joined to the same AD DS or Entra tenant, it cannot obtain a Kerberos ticket and identity-based SMB auth will fail - the user would need to use storage account key authentication instead. (4) Share-level RBAC (Storage File Data SMB Share Contributor) grants read/write/delete at the share level, but NTFS permissions at the directory/file level can further restrict or allow access. When evaluating each statement: a device that is AD DS domain-joined can authenticate User1 via on-premises AD Kerberos for Azure Files (if AD DS authentication is enabled on the storage account); a non-domain-joined device cannot use identity-based auth and would be blocked if key-based auth is not used; the combination of RBAC role + NTFS permissions determines effective access.

Concept tested. Azure Files identity-based SMB authentication using hybrid AD DS integration, the interplay between RBAC share-level permissions (Storage File Data SMB Share Contributor) and NTFS directory/file-level permissions, and the requirement for devices to be domain-joined to use Kerberos-based authentication for Azure Files shares.

Reference. https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable

Topics

#Azure Files#SMB access#hybrid identity#Azure AD DS#role-based access control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice