AZ-500 Practice Test 3 — 10 Questions

Question 1

An organization is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). They use Microsoft Defender for Cloud to manage their Azure security posture. Which feature in Defender for Cloud should they use to view their current compliance status against HIPAA controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Regulatory compliance dashboard.. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of your compliance posture against various standards, including HIPAA. It continuously assesses your Azure environment against HIPAA controls and displays the current compliance status, enabling you to track and improve adherence to regulatory requirements.

Answer

Security posture dashboard.

Answer

Recommendations dashboard.

Answer

Inventory dashboard.

Question 2

You need to ensure that external users who are invited to your Microsoft Entra ID tenant via B2B collaboration can only access a specific SaaS application. What should you configure?

Accepted Answer

Create a Conditional Access policy targeting the SaaS application and apply it to 'Guest or external users'.. A Conditional Access policy can be scoped to a specific SaaS application and applied to 'Guest or external users'. This ensures that only invited B2B collaboration users are subject to the access control for that application, while all other users and apps remain unaffected. The policy enforces authentication and authorization rules exclusively for the targeted SaaS app and guest identity type.

Answer

Configure SharePoint Online external sharing settings.

Answer

Create a Conditional Access policy targeting 'All cloud apps' and include guest users.

Answer

Use Microsoft Entra application proxy.

Question 3

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using a one-time passcode sent to their mobile device, without requiring any additional app or software installation. Which authentication method should you enable?

Accepted Answer

One-time passcode (OTP). The one-time passcode (OTP) authentication method in Microsoft Entra ID allows users to sign in with a temporary code sent via SMS to their mobile device, requiring no additional app or software installation. This method is specifically designed for scenarios where users cannot or should not install the Microsoft Authenticator app, such as for guest users or in bring-your-own-device (BYOD) environments. The OTP is generated by Entra ID and delivered over the mobile network, satisfying the requirement of no extra software.

Answer

Microsoft Authenticator app

Answer

FIDO2 security keys

Answer

Certificate-based authentication

Question 4

You are configuring a conditional access policy to block access from untrusted locations. The policy should apply to all cloud apps except Microsoft Entra ID Administration. How should you configure the policy?

Accepted Answer

Include 'All cloud apps' and exclude 'Microsoft Entra ID Administration'. The requirement is to block access from untrusted locations for all cloud apps except Microsoft Entra ID Administration. In Conditional Access, you include 'All cloud apps' to cover every app, then explicitly exclude 'Microsoft Entra ID Administration' to exempt it from the block. This ensures the policy applies broadly while honoring the exclusion.

Answer

Include 'All cloud apps' and set 'Block access'

Answer

Include 'Select apps' and choose all apps except admin

Answer

Include 'All cloud apps' and exclude 'Office 365'

Question 5

Your organization has Microsoft Entra ID and uses Microsoft Copilot for Microsoft 365. You need to ensure that Copilot interactions are logged and accessible for security investigations. What should you configure?

Accepted Answer

Ensure that auditing is enabled in Microsoft Purview to capture Copilot interactions. Microsoft Copilot for Microsoft 365 interactions are audited through the Microsoft Purview audit log. Enabling auditing in Purview captures detailed records of Copilot prompts and responses, which are then accessible for security investigations via the Purview compliance portal or through the Office 365 Management Activity API. This is the designated mechanism for logging Copilot activity, as Copilot interactions are considered Microsoft 365 workload events.

Answer

Configure Microsoft Sentinel to collect Copilot logs via the Office 365 connector

Answer

Enable diagnostic settings in Azure Monitor to collect Copilot logs

Answer

Deploy Microsoft Defender for Cloud Apps to monitor Copilot usage

Question 6

Your organization uses Microsoft Entra ID. You need to manage access to a line-of-business application that supports SAML 2.0. The application should be integrated as an enterprise application in Entra ID. What steps must you take?

Accepted Answer

Create a new enterprise application as a non-gallery app, configure SAML, assign users, and test. To integrate a line-of-business application that supports SAML 2.0 as an enterprise application in Microsoft Entra ID, you must create a new enterprise application using the 'Non-gallery application' option, configure SAML-based sign-on with the application's metadata, assign users or groups, and test the integration. This process allows you to define custom SAML attributes and claims specific to the application, which is necessary for non-gallery apps that are not pre-integrated.

Answer

Configure user consent settings for the application

Answer

Register the application in App Registrations and configure SAML

Answer

Add the application from the Azure AD gallery

Question 7

You are configuring Microsoft Entra ID Connect to synchronize on-premises Active Directory identities to the cloud. You need to ensure that password hashes are synchronized to enable Microsoft Entra ID Password Protection and Identity Protection. Which option should you enable?

Accepted Answer

Password hash synchronization. Password hash synchronization (PHS) is the correct option because it is the specific feature that synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID. This enables Microsoft Entra ID Password Protection (which blocks weak passwords by comparing against a global banned password list) and Identity Protection (which detects leaked credentials by comparing synchronized hashes against known compromised password databases). Without PHS, these cloud-based security features have no access to the on-premises password hashes.

Answer

Pass-through authentication

Answer

Federation with AD FS

Answer

Azure AD Connect Health

Question 8

Your company uses Microsoft Entra ID with a hybrid identity model. You need to implement a solution that allows you to block legacy authentication attempts while still allowing modern authentication protocols. What should you use?

Accepted Answer

Create a Conditional Access policy to block legacy authentication. Conditional Access policies in Microsoft Entra ID allow you to explicitly block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic auth) while permitting modern authentication (OAuth 2.0, OpenID Connect). By targeting the 'Client apps' condition and selecting 'Exchange ActiveSync clients' and 'Other clients', you can block all legacy auth attempts without affecting modern protocol traffic. This is the precise, granular control required for a hybrid identity model.

Answer

Enable Security defaults

Answer

Use Identity Protection to detect legacy authentication

Answer

Configure MFA for all users

Question 9

You are designing a secure access solution for an Azure App Service web application. The application uses Microsoft Entra ID for authentication. You need to ensure that only users from specific partner organizations can access the app. Which configuration should you use?

Accepted Answer

Configure the app to accept tokens from the partner tenants as external identity providers. Azure App Service can be configured to accept tokens from multiple Microsoft Entra ID tenants as external identity providers. This allows users from specific partner organizations to authenticate using their own Entra ID tenant, while the app validates the tokens and grants access only to those partner tenants you explicitly trust.

Answer

Use a custom domain for the app

Answer

Block all external users

Answer

Require multi-factor authentication for all users

Question 10

You are troubleshooting an issue where users are unable to access a sensitive application protected by a Conditional Access policy. The policy requires MFA from trusted locations, but users are reporting that they are prompted for MFA even when connecting from the corporate office, which is defined as a trusted location. What is the most likely cause?

Accepted Answer

The corporate office's public IP address is not correctly defined in the trusted location. The most likely cause is that the corporate office's public IP address is not correctly defined in the trusted location. Conditional Access policies evaluate location based on named locations configured in Microsoft Entra ID, which must include the exact public IP ranges (CIDR notation) of the trusted network. If the IP address is missing, misconfigured, or the user's outbound IP differs (e.g., due to a VPN or proxy), the policy treats the location as untrusted and enforces MFA.

Answer

The policy is configured to require MFA for all locations regardless of trust

Answer

The policy is set to 'Require MFA' instead of 'Require MFA from trusted locations'

Answer

Users are not assigned to the policy