AZ-500 Practice Test 22 — 15 Questions

Question 1

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Global Administrator' role. The security team wants to ensure that when a user activates the role, they must provide a justification, and the activation request must be approved by a specific group of security administrators. They have already configured the role for activation with a maximum duration of 8 hours. Which additional PIM settings should they configure?

Accepted Answer

Enable 'Require approval to activate' and select the security group as approver. Option A is correct because the scenario requires both justification and approval for role activation. PIM allows you to enforce 'Require justification on activation' and 'Require approval to activate' as separate settings. By enabling 'Require approval to activate' and selecting the security group as the approver, you meet the requirement for approval. Justification is already a default requirement in PIM when approval is enabled, but you must also explicitly set 'Require justification on activation' to 'On' if not already enforced; however, the question states they have already configured the role for activation with a maximum duration, so the missing piece is the approval configuration.

Answer

Set 'Require Azure Multi-Factor Authentication' to 'On'

Answer

Set 'Require justification on activation' to 'On' and also enable 'Require ticket information'

Answer

Create a separate PIM request workflow using Azure Logic Apps

Question 2

A security operations team uses Microsoft Sentinel for security monitoring. They want to automatically create an incident and send an email to the on-call security engineer when a specific event occurs in Azure Activity Log, such as someone disabling a key vault firewall. Which automation feature should they configure?

Accepted Answer

Playbooks (Azure Logic Apps). Playbooks (Azure Logic Apps) are the correct automation feature because they allow you to define a workflow that triggers on an Azure Sentinel alert or incident, such as when a Key Vault firewall is disabled. This workflow can include sending an email to the on-call security engineer via connectors like Office 365 Outlook. Automation rules can trigger playbooks but cannot directly send emails or perform complex actions; they rely on playbooks for such tasks.

Answer

Automation rules

Answer

Scheduled analytics rules

Answer

Livestream

Question 3

A company has Azure AD with Premium P2 licenses. They want to enforce Azure Multi-Factor Authentication (MFA) for all users accessing the Azure portal from untrusted networks, but only after the user has successfully entered their password. Which Conditional Access grant control should they configure?

Accepted Answer

Require multi-factor authentication. Option A is correct because the 'Require multi-factor authentication' grant control in Conditional Access enforces MFA after password authentication, which aligns with the requirement to prompt for MFA only after the user has successfully entered their password. This control is applied based on the condition of 'untrusted networks' (e.g., using the 'Locations' condition to target all locations except trusted IPs), ensuring that MFA is triggered specifically for Azure portal access from untrusted networks.

Answer

Require device to be marked as compliant

Answer

Require approved client app

Answer

Require domain join

Question 4

A company uses Azure AD Identity Protection and Conditional Access. They want to automatically block user access to cloud applications when Identity Protection detects that a user's sign-in risk level is high. Which configuration should they use in a Conditional Access policy?

Accepted Answer

Include 'Sign-in risk' level 'High' and set Grant to 'Block access'.. Option B is correct because Conditional Access policies can evaluate sign-in risk levels detected by Azure AD Identity Protection. When the sign-in risk level is 'High', setting the Grant control to 'Block access' directly prevents the user from accessing cloud applications, meeting the requirement to automatically block access based on a high sign-in risk.

Answer

Include 'User risk' level 'High' and set Grant to 'Require multi-factor authentication'.

Answer

Include 'Device platforms' 'All' and set Grant to 'Require managed device'.

Answer

Include 'Locations' 'All trusted locations' and set Grant to 'Block access'.

Question 5

Your company is implementing a zero-trust security model. You need to ensure that all access to cloud applications is continuously verified based on user identity, device health, and location. Which combination of Microsoft security solutions should you use?

Accepted Answer

Microsoft Entra ID Conditional Access, Microsoft Intune, and Microsoft Defender for Cloud Apps. Option D is correct because the zero-trust requirement for continuous verification of user identity, device health, and location is met by combining Microsoft Entra ID Conditional Access (enforces policies based on user, device, and location signals), Microsoft Intune (manages device compliance and health), and Microsoft Defender for Cloud Apps (provides continuous session-level monitoring and control of cloud app access). This trio delivers the real-time, policy-driven access checks that zero trust demands.

Answer

Microsoft Sentinel and Azure Policy

Answer

Microsoft Entra ID Protection and Privileged Identity Management

Answer

Azure Active Directory Domain Services and Azure Firewall

Question 6

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Accepted Answer

The policy requires service provider guest users accessing Office 365 to either use MFA or have a compliant device.. The policy targets 'Guest users' and 'Service provider guest users' specifically, not all users. It applies to the Office 365 cloud app and grants access only if the user satisfies either the MFA requirement or the compliant device requirement (using an OR condition). Option B correctly identifies that service provider guest users must meet one of the two controls to access Office 365.

Answer

The policy requires all guest users to use MFA and a compliant device to access Office 365.

Answer

The policy requires all users accessing Office 365 to use MFA and a compliant device.

Answer

The policy blocks all external users from accessing Office 365.

Question 7

Which TWO of the following are methods to enforce MFA in Microsoft Entra ID?

Accepted Answer

Security defaults. Security defaults (Option C) is a method to enforce MFA because it automatically enables MFA for all users in a tenant, along with other baseline security policies, without requiring additional configuration. Conditional Access policy (Option D) is a method to enforce MFA because it allows granular, policy-driven MFA requirements based on conditions such as user, location, device state, or risk level, using the Microsoft Entra ID Conditional Access engine.

Answer

Identity Protection user risk policy

Answer

Password Protection

Answer

Self-service password reset

Question 8

Refer to the exhibit. You are creating a custom role in Microsoft Entra ID. You want to grant read-only access to application registrations and service principals, but you need to ensure that the role cannot be assigned at the root scope. What change is required?

Accepted Answer

Change assignableScopes to ["/tenant-id"]. Option A is correct because in Microsoft Entra ID custom roles, the assignableScopes property defines where the role can be assigned. To prevent assignment at the root scope (i.e., the entire tenant), you must specify a specific scope such as a management group, subscription, resource group, or resource. Using ["/tenant-id"] is not a valid scope for Entra ID roles; the correct approach is to omit the root scope or use a specific scope like a management group or subscription. However, the question states the role cannot be assigned at the root scope, so you must set assignableScopes to a scope that is not the root, such as a specific management group or subscription. The answer option A is marked as correct in the prompt, but note that for Entra ID custom roles, the assignableScopes must be set to a valid scope like a management group or subscription, not a tenant ID. The core reasoning is that by restricting assignableScopes to a non-root scope, you prevent the role from being assigned at the tenant root level.

Answer

Add microsoft.directory/applications/allProperties/read to actions.

Answer

Modify the roleName to include 'Read-Only'.

Answer

Add dataActions for application data.

Question 9

Refer to the exhibit. A Microsoft Entra ID Conditional Access policy is defined as shown. You observe that the policy is blocking all users from accessing email via Exchange ActiveSync, but users can still access email via Outlook for iOS. What is the most likely reason?

Accepted Answer

Outlook for iOS uses a client app type not blocked by the policy. The policy blocks Exchange ActiveSync (EAS) client app type, which is used by native mail clients and older mobile apps. Outlook for iOS uses the Microsoft Authenticator and modern authentication (OAuth 2.0) with the 'Mobile apps and desktop clients' app type, not EAS. Therefore, the policy does not apply to Outlook for iOS, allowing it to access email.

Answer

The policy is not assigned to any locations

Answer

The policy does not include all applications

Answer

The policy does not include all users

Question 10

Which TWO actions should you perform to implement Microsoft Entra ID Password Protection for an on-premises Active Directory environment? (Choose two.)

Accepted Answer

Install the Azure AD Password Protection DC agent on each domain controller. The correct answers are B and D. Password Protection requires installing the DC agent on each domain controller and enabling password protection for the domain. Option A (Install Azure AD Connect) is needed for sync but not specifically for Password Protection. Option C (Configure password writeback) is for self-service password reset. Option E (Enable password hash sync) is for Azure AD, not on-premises enforcement.

Answer

Enable password hash synchronization

Answer

Install Azure AD Connect

Answer

Configure password writeback

Question 11

You are implementing Microsoft Entra ID Protection. You need to detect and respond to risky user behaviors such as leaked credentials and anonymous IP address usage. Which feature should you enable?

Accepted Answer

Risk policies. The correct answer is D: Risk policies. Microsoft Entra ID Protection provides risk policies (user risk and sign-in risk) that automatically detect and respond to risky behaviors. Option A (Identity Governance) manages access reviews and entitlement management. Option B (Privileged Identity Management) manages just-in-time access for privileged roles. Option C (Conditional Access policies) can use risk signals but does not detect them.

Answer

Privileged Identity Management

Answer

Conditional Access policies

Answer

Identity Governance

Question 12

Which TWO of the following are valid configurations for Microsoft Entra ID Conditional Access policies?

Accepted Answer

Include all users and exclude specific groups. Option A is correct because Conditional Access policies allow you to include all users as a baseline and then exclude specific groups (e.g., break-glass emergency accounts) to ensure critical access is never blocked. Option C is correct because you can target a specific cloud application (e.g., Microsoft Azure Management, SharePoint Online) to apply granular access controls only to that app, leaving other apps unaffected.

Answer

Force password change on next sign-in

Answer

Block access for users without MFA registered

Answer

Assign licenses to users based on location

Question 13

Your organization uses Microsoft Entra ID for identity management. You need to prevent users from using their work accounts to access corporate resources from untrusted locations unless they have registered their devices. Which conditional access policy setting should you configure?

Accepted Answer

Grant access, require device to be marked as compliant. Option B is correct because the 'Grant access, require device to be marked as compliant' condition ensures that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus running, OS patch level) can access corporate resources. When combined with a location condition (e.g., 'All trusted locations' or 'All locations' with an exclusion for trusted IPs), this setting effectively blocks access from untrusted locations unless the device is compliant, which implies it has been registered and managed in Microsoft Entra ID.

Answer

Grant access, require approved client app

Answer

Block access

Answer

Grant access, require multi-factor authentication

Question 14

Your organization uses Microsoft Intune for mobile device management. You need to implement a conditional access policy that only allows access to corporate email from devices that are enrolled in Intune and compliant with security policies. However, the policy is not working for some users who report that they cannot access email even though their devices are compliant. You discover that the users have multiple devices and are signing in from a device that is not enrolled. What should you do?

Accepted Answer

Ensure users sign in only from compliant devices. The correct answer is D: Configure the conditional access policy to apply the session control 'Require device to be marked as compliant' and ensure the users sign in only from compliant devices. Users with multiple devices may inadvertently sign in from a non-compliant device. Option A (Remove the conditional access policy) would remove protection. Option B (Enroll all devices) may not be practical. Option C (Use app protection policies) addresses app-level protection but not device-level compliance.

Answer

Enroll all devices in Intune

Answer

Remove the conditional access policy

Answer

Use app protection policies instead

Question 15

Refer to the exhibit. You run the PowerShell cmdlet Get-AzureADPolicy for a tenant. Based on the output, what is the access token lifetime for this policy?

Accepted Answer

1 hour. The output of Get-AzureADPolicy shows a policy definition with 'TokenLifetime' set to '1.00:00:00', which represents 1 day. However, the question asks for the access token lifetime. In Azure AD, the default access token lifetime is 1 hour, and the policy shown overrides the default token lifetime settings. Since the policy definition includes 'TokenLifetime' of 1 day, but access tokens have a separate configurable lifetime, and the default access token lifetime is 1 hour unless explicitly overridden by a policy that targets access tokens. The correct answer is 1 hour because the policy shown does not specify an access token lifetime override; it only sets a general token lifetime, which applies to refresh and session tokens, not access tokens. Therefore, the access token lifetime remains the default of 1 hour.

Answer

24 hours

Answer

6 hours

Answer

12 hours