AZ-500 Practice Test 23 — 15 Questions

Question 1

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?

Accepted Answer

Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.. Option B is correct because a Conditional Access policy can enforce device compliance as a grant control for Exchange Online, ensuring only compliant devices can access the service. Setting the session sign-in frequency to 12 hours forces users to reauthenticate at that interval, meeting the requirement without requiring MFA. This combines device compliance enforcement with session lifetime control in a single policy.

Answer

Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.

Answer

Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.

Answer

Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.

Question 2

Your organization uses Microsoft Entra ID and has several applications registered. You need to ensure that only specific applications can call a particular web API. The web API is also registered in Microsoft Entra ID. What should you configure?

Accepted Answer

In the web API's application registration, configure the 'expose an API' blade to define scopes, and then pre-authorize the specific client applications in the web API's manifest.. Option D is correct because pre-authorizing specific client applications in the web API's manifest (via the 'expose an API' blade) explicitly grants those clients permission to call the API without requiring user consent. This ensures that only the listed applications can acquire tokens for the API, as the API's application registration defines the scopes and pre-authorizations that control access.

Answer

Configure an app role assignment policy for the web API.

Answer

Set a token lifetime policy on the web API to accept tokens only from approved client applications.

Answer

Create a Conditional Access policy targeting the web API and require that the client application is managed.

Question 3

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access corporate email. You configure a Conditional Access policy targeting Exchange Online. Which grant control should you use?

Accepted Answer

Require device to be marked as compliant. Option A is correct because Require device to be marked as compliant ensures only compliant devices can access. Option B is wrong because Require MFA does not check device compliance. Option C is wrong because Require hybrid Azure AD join is for domain-joined devices. Option D is wrong because Block access is too restrictive.

Answer

Require multifactor authentication

Answer

Block access

Answer

Require hybrid Azure AD joined device

Question 4

Your organization uses Microsoft Entra ID and wants to implement a secure passwordless authentication strategy. Which TWO solutions can be used natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are a native passwordless authentication method in Microsoft Entra ID, leveraging the WebAuthn standard to provide phishing-resistant, hardware-based credential verification. They eliminate passwords entirely by using public-key cryptography, where the private key never leaves the device, ensuring strong security against credential theft.

Answer

Microsoft Authenticator app with OTP

Answer

Third-party password managers

Answer

Duo Security push notifications

Question 5

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?

Accepted Answer

Configure a Conditional Access policy that requires that the device be marked as compliant. Option B is correct because Conditional Access policies can enforce device compliance requirements. Option A is incorrect because MFA alone does not enforce device compliance. Option C is incorrect because Identity Protection focuses on risk, not device state. Option D is incorrect because device registration does not enforce compliance checks.

Answer

Configure a device registration policy

Answer

Configure an Identity Protection policy for user risk

Answer

Configure a Conditional Access policy that requires multi-factor authentication

Question 6

You manage a Microsoft Entra ID tenant for a multinational company. Users in the European office report that they cannot access the company's custom line-of-business application during peak hours, while users in the US office have no issues. The application uses OAuth 2.0 authentication with Conditional Access policies applied. What is the most likely cause?

Accepted Answer

The Conditional Access policy requires compliant devices, and European devices are taking longer to report compliance during peak hours.. Option C is correct because users in different regions may experience different authentication latency if the Conditional Access policy is configured to require compliant devices, and the device compliance evaluation may take longer during peak hours due to network congestion. Option A is wrong because MFA timeout is typically uniform per policy. Option B is wrong because token lifetime policies are applied globally. Option D is wrong because session revocation is not triggered by peak hours.

Answer

The application's service principal has been accidentally disabled in the European tenant location.

Answer

The Conditional Access policy requires multi-factor authentication for all users, and the MFA session token expired for European users.

Answer

The token lifetime policy for the application is set too low, causing European users to reauthenticate more frequently.

Question 7

You need to ensure that when a user's role in Microsoft Entra ID is changed (e.g., from User to Global Administrator), the change is approved by a manager before it takes effect. Additionally, you need to enforce just-in-time (JIT) access for that role. What should you use?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) for the role with approval required and JIT activation.. Microsoft Entra Privileged Identity Management (PIM) with approval workflows and JIT activation. Option B is wrong because Conditional Access does not manage role activation. Option C is wrong because access reviews are for periodic review, not JIT. Option D is wrong because role-based access control is for Azure RBAC, not Microsoft Entra roles.

Answer

Use Microsoft Entra access reviews to review role assignments monthly.

Answer

Create a Conditional Access policy requiring manager approval for role assignment.

Answer

Assign the role via Azure RBAC with a custom role.

Question 8

You are the security engineer for Contoso, a multinational company with 50,000 users in Microsoft Entra ID Premium P2. The company has a strict security policy requiring that all administrative actions be performed using just-in-time (JIT) access with approval, and that all privileged role activations be audited. Additionally, you need to ensure that Global Administrators are required to use phishing-resistant MFA (e.g., FIDO2 security keys) when activating their role. You have already configured Privileged Identity Management (PIM) for Azure AD roles. However, during a recent audit, you discovered that several Global Administrators were able to activate their role using only a text message (SMS) for MFA, violating the policy. You need to enforce the use of phishing-resistant MFA for all privileged role activations. What should you do?

Accepted Answer

Create a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' app and requires authentication strength 'Phishing-resistant MFA'. Option C is correct because Privileged Identity Management (PIM) role activation is triggered by signing in to the Azure AD Privileged Identity Management application (the PIM blade or API). By creating a Conditional Access policy that targets this specific app and requires the 'Phishing-resistant MFA' authentication strength, you enforce FIDO2 or Windows Hello for Business during the activation step, regardless of the user's baseline MFA method. This directly addresses the audit finding that Global Administrators were using SMS to activate their roles.

Answer

Create a Conditional Access policy that targets all cloud apps and requires authentication strength 'Phishing-resistant MFA'

Answer

In PIM, configure the role settings to require Azure MFA and set the authentication method to FIDO2

Answer

Configure authentication methods policy to allow only FIDO2 security keys for all users

Question 9

Your company uses Microsoft Entra ID with a hybrid identity model. You need to implement a solution that allows you to block legacy authentication attempts while still allowing modern authentication protocols. What should you use?

Accepted Answer

Create a Conditional Access policy to block legacy authentication. Conditional Access policies in Microsoft Entra ID allow you to explicitly block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic auth) while permitting modern authentication (OAuth 2.0, OpenID Connect). By targeting the 'Client apps' condition and selecting 'Exchange ActiveSync clients' and 'Other clients', you can block all legacy auth attempts without affecting modern protocol traffic. This is the precise, granular control required for a hybrid identity model.

Answer

Enable Security defaults

Answer

Use Identity Protection to detect legacy authentication

Answer

Configure MFA for all users

Question 10

Your organization uses Microsoft Entra ID. You need to manage access to a line-of-business application that supports SAML 2.0. The application should be integrated as an enterprise application in Entra ID. What steps must you take?

Accepted Answer

Create a new enterprise application as a non-gallery app, configure SAML, assign users, and test. Option C is correct because to integrate a line-of-business application that supports SAML 2.0 as an enterprise application in Microsoft Entra ID, you must create a new enterprise application using the 'Non-gallery application' option, configure SAML-based sign-on with the application's metadata, assign users or groups, and test the integration. This process allows you to define custom SAML attributes and claims specific to the application, which is necessary for non-gallery apps that are not pre-integrated.

Answer

Configure user consent settings for the application

Answer

Register the application in App Registrations and configure SAML

Answer

Add the application from the Azure AD gallery

Question 11

Your company uses Microsoft Entra ID and has Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud apps based on user behavior. Which feature should you use?

Accepted Answer

Conditional Access for Cloud Apps (session control). Option B is correct because session control in Conditional Access for Cloud Apps enables real-time monitoring and control. Option A is wrong because app proxy is for on-prem apps. Option C is wrong because DLP is for data protection. Option D is wrong because Cloud Discovery identifies shadow IT.

Answer

Information Protection (DLP)

Answer

Cloud Discovery

Answer

Application Proxy

Question 12

Your organization uses Microsoft Entra ID. You need to recommend solutions to reduce the risk of privileged role abuse. Which TWO actions should you recommend? (Choose two.)

Accepted Answer

Configure access reviews for privileged roles to run quarterly.. Option B is correct because PIM provides just-in-time access and approval workflows. Option D is correct because access reviews can periodically verify that role assignments are still needed. Option A is wrong because permanent role assignment increases risk. Option C is wrong because requiring MFA for all users does not target privileged roles. Option E is wrong because disabling sign-in logs reduces visibility.

Answer

Assign privileged roles permanently to reduce friction.

Answer

Disable sign-in logs for privileged users to reduce noise.

Answer

Require all users to use MFA for all applications.

Question 13

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

Accepted Answer

The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group. Option D is correct because PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Answer

Users have permanent eligible assignments that bypass approval

Answer

The audit log is not enabled for PIM

Answer

Users are assigned the role directly instead of through eligibility

Question 14

Which THREE of the following are required to configure Microsoft Entra ID self-service password reset (SSPR)?

Accepted Answer

Microsoft Entra ID P1 or P2 license. Microsoft Entra ID self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license because the SSPR feature is a premium capability that is not available in the Free or Office 365 app-only licenses. Without at least a P1 license, the tenant cannot enable or use SSPR for users. The P2 license adds additional protections like Identity Protection but is not strictly required for basic SSPR functionality.

Answer

Microsoft Entra ID Premium P2 license

Answer

Password writeback must be enabled

Question 15

Which THREE components are part of Microsoft Entra Conditional Access? (Choose three.)

Accepted Answer

Conditions (sign-in risk, device state, location). Microsoft Entra Conditional Access is a policy-based engine that evaluates signals to enforce access decisions. The three core components are Assignments (who the policy applies to, such as users, groups, or workload identities), Conditions (the signals evaluated, like sign-in risk, device state, or location), and Access Controls (the enforcement actions, such as grant or block access, and session controls). These three elements form the complete structure of a Conditional Access policy.

Answer

Multi-factor authentication service settings

Answer

Role assignments