AZ-500 Practice Test 24 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and requires that all accesses to sensitive applications be approved by the application owner. You need to implement a solution where users can request access to these applications, and the request is automatically routed to the owner for approval. What should you configure?

Accepted Answer

Entitlement management access packages. Option D is correct. Microsoft Entra entitlement management allows you to create access packages requiring approval from the application owner. Option A is wrong because it is for role activation. Option B is wrong because it is for administrative roles. Option C is wrong because it is for external collaboration.

Answer

Microsoft Entra roles and administrative units

Answer

Privileged Identity Management for groups

Answer

Cross-tenant access settings

Question 2

Your organization wants to ensure that users accessing Office 365 from outside the corporate network must use MFA. What is the most efficient way to enforce this?

Accepted Answer

Create a Conditional Access policy for Office 365 with location condition and require MFA.. Option D is correct because it specifically targets Office 365 cloud apps and uses the location condition to restrict MFA enforcement to access from outside the corporate network. This is the most efficient approach as it applies only to the relevant application and network location, minimizing user friction while meeting the requirement exactly.

Answer

Enable MFA for all users in Microsoft Entra ID.

Answer

Create a Conditional Access policy for all cloud apps with location condition.

Answer

Use Conditional Access with device compliance condition.

Question 3

An organization requires that all Azure SQL Database connections from non-corporate networks must be blocked unless initiated through Azure Bastion. Which Microsoft Entra ID Conditional Access policy setting should be configured?

Accepted Answer

Block access. Option A is correct because the requirement is to block all Azure SQL Database connections from non-corporate networks unless they go through Azure Bastion. In Microsoft Entra ID Conditional Access, the 'Block access' control explicitly denies authentication requests that match the policy conditions. By configuring a policy that targets the Azure SQL Database application and includes conditions for non-corporate network locations, the 'Block access' grant effectively enforces the restriction, allowing only connections routed through Azure Bastion (which originates from a corporate network or a trusted IP).

Answer

Require sign-in frequency

Answer

Require multifactor authentication (MFA)

Answer

Require device to be marked as compliant

Question 4

Your organization uses Microsoft Entra ID and plans to deploy Microsoft Copilot for Security. You need to ensure that Copilot's access to security data is governed by the principle of least privilege and that usage is auditable. What should you implement?

Accepted Answer

Implement Microsoft Purview for data governance and assign custom RBAC roles in Copilot for Security.. Option B is correct because Microsoft Purview provides the data governance framework needed to classify, label, and control access to security data, while custom RBAC roles in Copilot for Security allow granular permissions that enforce least privilege. This combination ensures that Copilot only accesses data necessary for its function and that all access is auditable through Purview's audit logs.

Answer

Use Conditional Access policies to restrict Copilot access based on location and device compliance.

Answer

Enable Microsoft Entra ID Protection to detect risky usage of Copilot.

Answer

Assign the Copilot roles via Privileged Identity Management (PIM) with approval workflows.

Question 5

Your company uses Microsoft Entra ID. You need to block sign-ins from countries where your company does not operate. Which approach should you use?

Accepted Answer

Create a Conditional Access policy to block access from those countries. Option B is correct because Conditional Access policies can block sign-ins by geographic location. Option A is wrong because MFA doesn't block by location. Option C is wrong because Named locations are used in Conditional Access, but they define trusted locations, not block others. Option D is wrong because Identity Protection detects risky sign-ins but does not block by country.

Answer

Configure MFA for all users

Answer

Use Identity Protection user risk policy

Answer

Add those countries as Named locations

Question 6

Your company uses Microsoft Entra ID with a custom domain. You need to implement a solution that allows users to sign in using their social identity providers (e.g., Google, Facebook) but still enforce your organization's MFA policies. What should you configure?

Accepted Answer

Configure Custom Authentication Extension to federate with social IdPs and apply Conditional Access policy requiring MFA.. Create a Custom Authentication Extension that calls an external identity provider, then apply Conditional Access with MFA. Option B is wrong because B2B collaboration is for external users, not for your own users using social IdPs. Option C is wrong because self-service password reset does not provide social sign-in. Option D is wrong because federation does not support social IdPs natively.

Answer

Configure federation with the social IdP in Microsoft Entra ID.

Answer

Use Microsoft Entra B2B collaboration and invite users with their social accounts.

Answer

Enable self-service password reset (SSPR) with identity verification.

Question 7

Your organization has Microsoft Entra ID P2 licenses. You want to automatically detect and respond to compromised identities by requiring MFA when a sign-in risk is medium or above. Which policy should you configure?

Accepted Answer

Configure an Identity Protection user risk policy to require MFA. Option A is correct because Identity Protection user risk policy can automatically trigger MFA based on risk level. Option B is incorrect because sign-in risk policy is for sign-in risk, not user risk. Option C is incorrect because Conditional Access is the foundation but the policy type is Identity Protection. Option D is incorrect because it requires user action.

Answer

Enable self-service password reset

Answer

Configure a Conditional Access policy with sign-in risk condition

Answer

Configure an Identity Protection sign-in risk policy

Question 8

Your organization uses Microsoft Entra ID. The security team wants to ensure that users cannot reuse the last five passwords. Which feature should you configure?

Accepted Answer

Password expiration policy. Option C is correct because password expiration policy can enforce password history to prevent reuse. Option A is wrong because SSPR is for self-reset. Option B is wrong because Password Protection blocks weak passwords. Option D is wrong because MFA adds a second factor.

Answer

Multifactor authentication

Answer

Password Protection

Answer

Self-service password reset

Question 9

Your organization is using Microsoft Entra ID Conditional Access to enforce MFA for all external users. A partner company reports that their users are prompted for MFA every time they access your resources, even though they already authenticated in their home tenant. What should you configure to reduce repeated prompts?

Accepted Answer

Configure MFA lifetime settings via cross-tenant access settings. Option B is correct. Configuring MFA lifetime settings for federated users reduces the frequency of MFA prompts by allowing longer token validity. Option A is wrong because session control does not reduce MFA frequency. Option C is wrong because it does not apply to external users. Option D is wrong because sign-in frequency controls session reauthentication, not MFA lifetime.

Answer

Modify the external user’s home tenant conditional access policy

Answer

Set sign-in frequency to 0 (zero) for the conditional access policy

Answer

Configure session control to use persistent browser session

Question 10

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM). You need to ensure that all privileged role activations are approved by a manager and require a ticket number. What should you configure in PIM?

Accepted Answer

Role settings for the privileged role. Option A is correct because role settings in PIM allow you to configure approval and justification. Option B is wrong because access reviews are for periodic reviews. Option C is wrong because alerts are for notifications. Option D is wrong because audit history is for logging.

Answer

Audit history

Answer

Alerts

Answer

Access reviews

Question 11

You are a security engineer for a company that uses Microsoft Entra ID. You need to implement a solution that automatically blocks sign-ins from users detected as compromised credentials. The solution should work in real-time and require no manual intervention. What should you use?

Accepted Answer

User risk policy in Microsoft Entra ID Protection. Option B is correct. Microsoft Entra ID Protection automatically detects and blocks compromised credentials using user risk policies. Option A is wrong because it is not real-time. Option C is wrong because it is not specific to compromised credentials. Option D is wrong because it is a reporting tool.

Answer

Azure AD Identity Protection weekly digest

Answer

Conditional Access policy with sign-in risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Question 12

Your organization uses Microsoft Entra ID to manage identities. You need to ensure that users can reset their own passwords without help desk intervention, but they must register for self-service password reset (SSPR) first. Which configuration is required?

Accepted Answer

Enable SSPR and set the registration campaign to require registration at next sign-in. Option A is correct. SSPR requires users to register authentication methods before they can reset passwords. Option B is wrong because combined registration is not mandatory. Option C is wrong because password protection is unrelated. Option D is wrong because it applies to administrators.

Answer

Configure Microsoft Entra Password Protection

Answer

Enable Privileged Identity Management for SSPR

Answer

Enable combined registration for SSPR and Microsoft Entra ID Protection

Question 13

You have configured the Conditional Access policy shown in the exhibit. Users report that they can still access Exchange Online using legacy authentication protocols. What is the most likely reason?

Accepted Answer

The policy state is set to reporting mode. Option B is correct. The policy state is 'enabledForReportingButNotEnforced', meaning it only reports without blocking. Option A is wrong because legacy authentication is included. Option C is wrong because other clients are included. Option D is wrong because it is a valid block policy.

Answer

The policy should use 'Require MFA' instead of 'Block'

Answer

The policy does not include the correct client app types

Answer

The policy should include 'mobileAppsAndDesktopClients' instead

Question 14

Refer to the exhibit. You are reviewing a custom Microsoft Entra role for an application developer. A developer reports that they cannot register an application even though they have the 'applications/create' permission. What is the most likely cause?

Accepted Answer

The developer does not have permission to consent to application permissions.. To register applications, the user must also have consent to grant permissions. The permission 'microsoft.directory/applications/create' allows creating app registrations, but the user may not have the necessary consent permissions (e.g., 'microsoft.directory/applications/update' which includes consent management). Alternatively, the user might need to be a Global Administrator to consent to permissions. However, the role definition includes create, update, delete, so they should be able to create. Perhaps the issue is that they need to consent to the application's permissions. The most likely cause is that the developer does not have the 'Consent to applications' permission, which is a separate action. The exhibit does not include that action.

Answer

The developer is not a Global Administrator.

Answer

The role needs to be assigned at the root scope.

Answer

The role is not assigned to the developer.

Question 15

Your company uses Microsoft Entra ID with P2 licenses. You need to implement a policy that automatically revokes access for users who are detected as high risk by Microsoft Entra ID Protection. The policy must allow users to self-remediate by performing MFA. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires MFA for users with high user risk.. A Conditional Access policy with 'Require multifactor authentication' grant and 'High risk' user risk condition allows users to self-remediate via MFA while blocking access if high risk is detected. Option A is wrong because user risk policy in ID Protection triggers automatic remediation or block, not user self-remediation. Option C is wrong because session risk policy focuses on sign-in risk, not user risk. Option D is wrong because it blocks access without self-remediation.

Answer

Enable the 'Require password change' user risk policy in ID Protection.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to require MFA.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block access.