AZ-500 Practice Test 25 — 15 Questions

Question 1

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user accounts and enable self-service password reset (SSPR) for cloud users. You have set up Microsoft Entra Connect Sync. Which additional configuration is required to allow password writeback for SSPR?

Accepted Answer

Enable password writeback in Microsoft Entra Connect and assign Azure AD Premium licenses. Option C is correct because password writeback requires an Azure AD Premium license and the writeback feature enabled in Entra Connect. Option A is incorrect because password hash sync alone does not enable writeback. Option B is incorrect because PHS is not required for writeback. Option D is incorrect because Password Protection is a separate feature.

Answer

Configure pass-through authentication

Answer

Enable password hash synchronization

Answer

Install the Azure AD Password Protection proxy

Question 2

Your company has Microsoft Entra ID and uses Azure Bastion for secure VM access. You need to ensure that only administrators with PIM-activated roles can access the Bastion host. What should you configure?

Accepted Answer

Use a Conditional Access policy to require privileged access for the Azure Bastion application. Option B is correct because Bastion does not support Conditional Access directly, but you can use a Conditional Access policy targeting the Bastion service with a session control for privileged access. Option A is incorrect because Bastion does not support just-in-time access natively. Option C is incorrect because network policies are not granular enough. Option D is incorrect because RBAC alone does not enforce activation.

Answer

Configure Azure Bastion with just-in-time access

Answer

Assign the Bastion Reader role to administrators

Answer

Configure network security groups to restrict access to Bastion

Question 3

You are troubleshooting a sign-in issue. A user reports that they are repeatedly prompted for authentication when accessing a cloud app, even though they already authenticated earlier in the day. You check the Conditional Access policy and see that 'Session control - Sign-in frequency' is set to 1 hour. What is the most likely cause?

Accepted Answer

The sign-in frequency setting forces reauthentication after 1 hour. Option C is correct. A sign-in frequency of 1 hour will prompt reauthentication every hour, causing the repeated prompts. Option A is wrong because token lifetime settings are separate. Option B is wrong because session persistence does not affect reauthentication frequency. Option D is wrong because risk policies are not configured.

Answer

The browser is blocking persistent cookies

Answer

Token lifetime policy overrides the sign-in frequency

Answer

The user is considered high risk by Identity Protection

Question 4

You executed the PowerShell script shown in the exhibit. What is the result?

Accepted Answer

All users are added to the Global Administrator role. Option D is correct. The script adds all users with @contoso.com suffix to the Global Administrator role, which is a security risk. Option A is wrong because it doesn't remove. Option B is wrong because it doesn't filter by role. Option C is wrong because it does add them.

Answer

All users are removed from the Global Administrator role

Answer

No users are added because of an error

Answer

Only users with the Global Administrator role are listed

Question 5

Which THREE of the following are recommended practices for securing administrative accounts in Microsoft Entra ID?

Accepted Answer

Use separate administrative accounts for day-to-day administration. A, B, and E are correct. Option A is correct because break-glass accounts should be excluded from MFA to ensure access during emergencies. Option B is correct because using dedicated admin accounts reduces risk. Option C is wrong because registering all admins for self-service password reset is not a security practice for admin accounts. Option D is wrong because permanent assignment defeats JIT. Option E is correct because Conditional Access should require MFA for admins.

Answer

Register all administrative accounts for self-service password reset (SSPR)

Answer

Assign Global Administrator role permanently to all IT staff

Question 6

Refer to the exhibit. A user's sign-in to Azure Portal failed MFA. The risk level is medium due to leaked credentials. Conditional Access was not applied. What is the most likely reason for MFA failure?

Accepted Answer

The user's credentials were compromised, leading to a failed MFA attempt possibly due to incorrect code.. The user had leaked credentials (leakedCredentials risk event) which indicates their password was compromised. Even though MFA was required, the attempt failed. The MFA failure is likely because the user did not complete MFA successfully, not because MFA was not configured. Conditional Access not applied means no policy enforced MFA; however, MFA requirement might be from user-level MFA or per-user MFA. The leaked credentials risk event suggests the user's credentials are compromised, and MFA failure could be due to the user not having MFA registered or token issues. But the best explanation is that the user's password was leaked and the sign-in was blocked by risk policy? Actually, risk policy was not applied (ConditionalAccessStatus: notApplied). The MFA failure could be because the user attempted MFA but failed (e.g., invalid code). The leaked credentials event is a risk detection that likely triggered a user risk policy requiring MFA, but policy not applied? However, the log shows ConditionalAccessStatus: notApplied. So likely MFA was required per-user but failed. Given the risk event, the most probable cause is that the user's credentials were compromised, and the MFA failure is due to user error or token issue.

Answer

The user's password was leaked, and the sign-in was blocked by a risk-based policy.

Answer

The user did not have MFA registered, so the MFA attempt failed.

Answer

Conditional Access policy required MFA but was not applied due to licensing issue.

Question 7

Your organization uses Microsoft Entra ID and has deployed Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud applications based on user behavior and device health. Which feature should you use?

Accepted Answer

Conditional Access App Control. Option A is correct because Conditional Access App Control in Defender for Cloud Apps allows session-level monitoring and control based on user and device conditions. Option B is wrong because Cloud App Discovery only discovers shadow IT. Option C is wrong because OAuth app policies govern third-party app permissions. Option D is wrong because Information Protection is for data classification and labeling.

Answer

Microsoft Purview Information Protection

Answer

Cloud App Discovery

Answer

OAuth app policies

Question 8

A company uses Microsoft Entra ID and has an application registered that exposes scopes. An external partner organization needs to authenticate and access a specific scope. The partner's tenant is not federated. What is the most secure way to provide access without creating user accounts?

Accepted Answer

Configure an enterprise application with 'Users and groups' assignment and set 'Assignment required?' to Yes. The correct answer is B: Configure an enterprise application with 'Users and groups' assignment and set 'Assignment required?' to Yes. This allows the partner to authenticate via their own credentials without creating user accounts. Option A is wrong because it creates guest users. Option C is wrong because it bypasses access control. Option D is wrong because it exposes the app to all users.

Answer

Set the application to be multitenant and allow any user to sign in

Answer

Create a service principal and share the client secret

Answer

Create guest users in the tenant and assign licenses

Question 9

Which TWO actions should you take to implement a zero-trust identity model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Configure Privileged Identity Management to require approval for role activation. Options B and D are correct. B is correct because Conditional Access policies are a core component of zero-trust, verifying identity and device health. D is correct because PIM enforces just-in-time access, reducing standing privileges. A is incorrect because password expiration does not enhance zero-trust. C is incorrect because permanent role assignments oppose zero-trust. E is incorrect because synchronization alone does not enforce zero-trust.

Answer

Configure password expiration policies to force frequent changes

Answer

Enable password hash synchronization to Azure AD

Answer

Assign permanent Global Administrator roles to IT staff

Question 10

You are a security administrator for a financial institution. You need to implement a solution that allows users to authenticate using biometrics and prevents password-based attacks. Which Microsoft Entra ID feature should you enable?

Accepted Answer

Passwordless authentication (FIDO2 or Windows Hello for Business). Option A is correct because Passwordless authentication methods like FIDO2 security keys or Windows Hello for Business eliminate passwords and support biometrics. Option B is wrong because password hash sync still uses passwords. Option C is wrong because MFA requires something you know (password) and something you have, but still uses passwords. Option D is wrong because Identity Protection detects risks but does not eliminate passwords.

Answer

Microsoft Entra ID Protection

Answer

Password hash synchronization

Answer

Azure Multi-Factor Authentication

Question 11

You are managing a Microsoft Entra ID tenant with external collaboration enabled. You need to restrict external user access to only the groups and applications they are explicitly granted. You also want to prevent external users from seeing other external users in the tenant directory. Which settings should you configure?

Accepted Answer

Set 'Guest user access restrictions' to 'Guest users have limited access...' and configure 'External collaboration settings' to restrict external user visibility. Option D is correct because collaboration restrictions limit external user visibility to groups and apps they are assigned, and external users can be restricted from seeing other users. Option A is wrong because guest user access restrictions control permissions but not visibility. Option B is wrong because cross-tenant access settings are for inbound/outbound trust. Option C is wrong because entitlement management is for access packages.

Answer

Use Microsoft Entra entitlement management to create access packages for external users

Answer

Configure cross-tenant access settings to block all external collaboration

Answer

Set 'Guest user access restrictions' to 'Guest users have same access as members'

Question 12

You work for a software development company that uses GitHub Enterprise and Microsoft Entra ID for identity management. Developers need to access Azure resources from their CI/CD pipelines. You need to configure secure authentication for these service principals used in pipelines. The requirements are:

- No client secrets should be used because they can be leaked.
- The authentication method must be automatically rotated.
- The service principal must have access only to a specific resource group.
- You need to monitor and alert if the service principal is used outside of the expected geographic region.

Which of the following is the most appropriate solution?

Accepted Answer

Use a system-assigned managed identity for the Azure resource running the pipeline. Assign the managed identity the Contributor role at the resource group scope. Configure Conditional Access for workload identities to block sign-ins from unexpected geographic regions.. Option B is correct. Managed identities for Azure resources eliminate secrets and are automatically rotated. They can be scoped to a resource group via RBAC. Conditional Access for workload identities can restrict access based on location. Option A is wrong because certificate-based authentication still requires managing certificates. Option C is wrong because OAuth 2.0 with client credentials uses client secrets. Option D is wrong because PIM is for user identities, not workload identities.

Answer

Create a service principal with a certificate-based credential. Assign the service principal the Contributor role at the resource group scope. Use a custom script to rotate the certificate monthly.

Answer

Use a user-assigned managed identity and configure PIM to require approval for each pipeline run. Assign the identity the Contributor role at the resource group scope.

Answer

Create a service principal and use OAuth 2.0 client credentials grant with a client secret stored in Azure Key Vault. Assign the service principal the Contributor role at the resource group scope. Use Key Vault access policies to control secret access.

Question 13

Refer to the exhibit. A custom role definition is created with the JSON above. A user assigned this role in the Prod resource group attempts to restart a VM but receives an authorization error. What is the most likely cause?

Accepted Answer

The role definition lacks the 'Microsoft.Compute/virtualMachines/read' action. The correct answer is A: The role definition is missing the 'Microsoft.Compute/virtualMachines/read' action. Without read, the user cannot see or interact with the VM, leading to authorization errors. Option B is wrong because the assignable scope is correct. Option C is wrong because the user is assigned the role. Option D is wrong because the role is not missing the restart action.

Answer

The assignable scope should include the subscription

Answer

The role definition includes 'restart' but not 'start'

Answer

The user is not assigned the role at the correct scope

Question 14

A company uses Microsoft Entra ID and has a custom application that authenticates via OAuth 2.0 device authorization grant. The app recently started receiving 'access_denied' errors for some users. The errors occur only for users who have Conditional Access policies applied. What change should be made to fix the issue while maintaining security?

Accepted Answer

Configure the Conditional Access policy to exclude the custom application's service principal from requiring device compliance. The correct answer is C: Configure the Conditional Access policy to exclude the custom application's service principal from requiring device compliance. The device authorization grant flow does not support device compliance, causing the error. Option A is wrong because MFA can work with device code flow. Option B is wrong because disabling Conditional Access is not secure. Option D is wrong because the error is not due to authentication method.

Answer

Require MFA for the application instead of device compliance

Answer

Disable Conditional Access for the affected users

Answer

Change the application to use authorization code grant flow

Question 15

Your company uses Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with company policies can access corporate resources. You have configured compliance policies in Intune. What additional step is required to enforce access control based on device compliance?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant. Option B is correct because Conditional Access policies in Entra ID enforce access based on device compliance status. Option A is wrong because device configuration profiles apply settings but do not enforce access. Option C is wrong because app protection policies manage data within apps. Option D is wrong because certificates are for authentication, not compliance enforcement.

Answer

Enable certificate-based authentication for all devices

Answer

Deploy device configuration profiles to all devices

Answer

Configure app protection policies in Microsoft Defender for Cloud Apps