AZ-500 Practice Exam 62 — 20 Questions

Question 1

Refer to the exhibit. You are configuring an Entitlement Management access package. The policy allows any existing user to request access without approval, and access expires after 30 days. However, security requirements dictate that all access to Finance applications must be reviewed by the finance team manager every quarter. What should you add to the policy?

Accepted Answer

Enable access reviews and assign the finance team manager as reviewer. Option D is correct because the security requirement mandates quarterly reviews by the finance team manager, which is exactly what an access review does in Entitlement Management. Access reviews allow you to require periodic attestation of access by a designated reviewer, ensuring ongoing compliance even though the initial request does not require approval. The policy already sets a 30-day expiration, but a quarterly review adds a separate recurring governance check that overrides the shorter duration for compliance purposes.

Answer

Add a connected organization for external users

Answer

Set 'isApprovalRequiredForAdd' to true

Answer

Set 'durationInDays' to 90

Question 2

Which THREE conditions can be used in a Microsoft Entra ID Conditional Access policy to control access based on sign-in risk? (Choose three.)

Accepted Answer

Low. Option B is correct because Microsoft Entra ID Conditional Access policies allow you to configure sign-in risk as a condition, and 'Low' is one of the three available risk levels (Low, Medium, High) that can be used to trigger access controls. Sign-in risk is calculated by Microsoft's identity protection service based on real-time signals such as anonymous IP addresses, atypical travel, or leaked credentials, and you can require multi-factor authentication or block access when the risk level meets or exceeds the selected threshold.

Answer

All

Answer

None

Question 3

Which TWO of the following are required to implement a successful Just-In-Time (JIT) access strategy using Microsoft Entra Privileged Identity Management (PIM) for Azure resources?

Accepted Answer

Configure role settings to specify activation duration and require approval if needed. Option C is correct because configuring role settings in Microsoft Entra PIM, such as activation duration and requiring approval, is essential to control how and when eligible users activate their JIT access. These settings enforce security policies like time-bound activation and multi-step approval, which are core to a successful JIT strategy.

Answer

Enable Azure Multi-Factor Authentication for all users in the tenant

Answer

Create custom RBAC roles for the JIT access

Answer

Assign users as permanently active for the roles they need

Question 4

Refer to the exhibit. A user is eligible for a role in PIM. When they activate the role, how long will the activation last?

Accepted Answer

8 hours. In Azure AD Privileged Identity Management (PIM), the default maximum activation duration for an eligible role is 8 hours. This is configurable by administrators, but the question refers to the standard default setting. When a user activates a role, the activation lasts for this predefined period unless a different duration is explicitly set in the role settings.

Answer

1 hour

Answer

24 hours

Answer

Indefinite

Question 5

You are designing a secure access solution for an Azure App Service web application. The application uses Microsoft Entra ID for authentication. You need to ensure that only users from specific partner organizations can access the app. Which configuration should you use?

Accepted Answer

Configure the app to accept tokens from the partner tenants as external identity providers. Option B is correct because Azure App Service can be configured to accept tokens from multiple Microsoft Entra ID tenants as external identity providers. This allows users from specific partner organizations to authenticate using their own Entra ID tenant, while the app validates the tokens and grants access only to those partner tenants you explicitly trust.

Answer

Use a custom domain for the app

Answer

Block all external users

Answer

Require multi-factor authentication for all users

Question 6

Refer to the exhibit. You are configuring a PIM role setting for an Azure AD role. The exhibit shows the activation settings. A user activates the role and provides a justification. An approver from the Security Team does not see any pending requests. What is the most likely reason?

Accepted Answer

The user is a member of the approver group. Option D is correct because the user who activated the role is a member of the approver group. In Azure AD Privileged Identity Management (PIM), when a user is both the requester and a member of the approver group, the approval request is automatically approved and does not appear as a pending request for other approvers. This self-approval behavior prevents the request from being visible in the pending requests queue.

Answer

The role is permanently assigned

Answer

The activation duration is set to 0 days

Answer

The user did not provide a justification

Question 7

Your organization uses Microsoft Entra ID and wants to provide external partners with access to a specific SharePoint Online site. You need to ensure that partners authenticate using their own corporate credentials (SAML/WS-Fed) and that access is automatically revoked when the partner's account is disabled. Which solution should you use?

Accepted Answer

Microsoft Entra B2B collaboration with cross-tenant access settings. Microsoft Entra B2B collaboration with cross-tenant access settings is the correct solution because it allows external partners to authenticate using their own corporate identity provider via SAML/WS-Fed, and it automatically revokes access when the partner's account is disabled in their home tenant. This is achieved through inbound trust settings that honor the partner tenant's user lifecycle, ensuring that access tokens are invalidated when the external user account is disabled or deleted.

Answer

Azure AD B2C

Answer

Direct federation

Answer

SharePoint external sharing

Question 8

Refer to the exhibit. You are analyzing a Conditional Access policy JSON. The policy requires MFA for Office 365 applications. However, users report that they are still able to access Office 365 without MFA. What is the most likely reason?

Accepted Answer

The 'authenticationStrength' property is not a valid Conditional Access policy property. The 'authenticationStrength' property is not a valid property in a Conditional Access policy JSON schema. Conditional Access policies use 'grantControls' with 'builtInControls' (e.g., 'mfa') to enforce MFA. An unrecognized property like 'authenticationStrength' would be ignored by Azure AD, causing the policy to not enforce MFA as intended.

Answer

The policy excludes some Office 365 apps

Answer

The 'grantControls' section is empty

Answer

The policy does not include all users

Question 9

You are designing a Microsoft Entra ID tenant for a multinational organization. The security team requires that all administrative users must use phishing-resistant MFA. Administrators are located in different regions and may use different devices. Which MFA method should you enforce?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the only option that provides phishing-resistant MFA, as they use public-key cryptography and are bound to a specific web origin, preventing credential theft via man-in-the-middle attacks. This satisfies the security team's requirement for all administrative users, regardless of region or device, because FIDO2 keys are hardware-based and interoperable across platforms.

Answer

SMS-based verification

Answer

Phone call verification

Answer

Microsoft Authenticator with OTP

Question 10

You need to ensure that external users who are invited to your Microsoft Entra ID tenant via B2B collaboration can only access a specific SaaS application. What should you configure?

Accepted Answer

Create a Conditional Access policy targeting the SaaS application and apply it to 'Guest or external users'.. Option C is correct because a Conditional Access policy can be scoped to a specific SaaS application and applied to 'Guest or external users'. This ensures that only invited B2B collaboration users are subject to the access control for that application, while all other users and apps remain unaffected. The policy enforces authentication and authorization rules exclusively for the targeted SaaS app and guest identity type.

Answer

Configure SharePoint Online external sharing settings.

Answer

Create a Conditional Access policy targeting 'All cloud apps' and include guest users.

Answer

Use Microsoft Entra application proxy.

Question 11

Which TWO of the following are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Sign-in risk policy. Microsoft Entra ID Protection provides two risk-based policies: a sign-in risk policy (Option B) and a user risk policy (Option C). The sign-in risk policy evaluates the likelihood that an authentication request is not legitimate based on real-time signals such as anonymous IP addresses, atypical travel, or malware-linked IPs, and can automatically block or require multi-factor authentication (MFA). The user risk policy assesses the probability that a user's credentials have been compromised, based on events like leaked credentials or suspicious activity, and can force a password reset or block sign-in.

Answer

Conditional Access session controls

Answer

Access reviews

Answer

Role-based access control (RBAC)

Question 12

Which TWO methods can be used to protect privileged accounts in Microsoft Entra ID? (Choose two.)

Accepted Answer

Create a Conditional Access policy that requires MFA for privileged roles. Option D is correct because requiring MFA for privileged roles via a Conditional Access policy adds a critical layer of security, ensuring that even if credentials are compromised, an attacker cannot authenticate without the second factor. This directly mitigates the risk of credential theft for high-privilege accounts. Option E is correct because Privileged Identity Management (PIM) provides just-in-time (JIT) access, reducing the attack surface by granting administrative roles only when needed and for a limited duration, with approval workflows and auditing.

Answer

Enable external identities for guest users

Answer

Enable self-service password reset for all users

Answer

Register all devices with Azure AD

Question 13

You are designing a security baseline for Microsoft Entra ID. Which THREE settings are recommended by Microsoft as part of the identity security baseline?

Accepted Answer

Enable risk-based Conditional Access policies. Option A is correct because risk-based Conditional Access policies are a core recommendation in the Microsoft identity security baseline. These policies automatically respond to detected user or sign-in risks (e.g., anonymous IP, leaked credentials) by requiring MFA or blocking access, aligning with the Zero Trust principle of continuous verification. Microsoft explicitly includes risk-based policies in its security baseline to proactively mitigate identity threats.

Answer

Allow self-service group management for all users

Answer

Set sign-in session timeout to 8 hours

Question 14

You are designing a privileged identity management strategy for Microsoft Entra ID. You need to ensure that eligible role assignments require approval from a designated group before activation. What configuration is required?

Accepted Answer

In PIM, configure the role settings to require approval and specify an approver group. Option C is correct because Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role settings to require approval for activation. By specifying an approver group, you ensure that eligible role assignments cannot be activated without explicit approval from designated members, enforcing a just-in-time (JIT) access control model.

Answer

Configure the role as eligible and set activation duration

Answer

Configure a Conditional Access policy with approval control

Answer

Create an access review for the role

Question 15

Which THREE of the following can be used to provide just-in-time (JIT) privileged access to Azure resources?

Accepted Answer

Privileged Access Groups (PAG). Privileged Access Groups (PAG) allow you to manage just-in-time (JIT) access by assigning users to a group that has time-bound, activated roles. When a user activates their membership in a PAG via Microsoft Entra Privileged Identity Management (PIM), they receive the necessary permissions for a specified duration, providing JIT privileged access to Azure resources.

Answer

Conditional Access

Answer

Azure RBAC role assignment

Question 16

You are configuring Microsoft Entra ID Connect to synchronize on-premises Active Directory identities to the cloud. You need to ensure that password hashes are synchronized to enable Microsoft Entra ID Password Protection and Identity Protection. Which option should you enable?

Accepted Answer

Password hash synchronization. Password hash synchronization (PHS) is the correct option because it is the specific feature that synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID. This enables Microsoft Entra ID Password Protection (which blocks weak passwords by comparing against a global banned password list) and Identity Protection (which detects leaked credentials by comparing synchronized hashes against known compromised password databases). Without PHS, these cloud-based security features have no access to the on-premises password hashes.

Answer

Pass-through authentication

Answer

Federation with AD FS

Answer

Azure AD Connect Health

Question 17

Which TWO of the following are valid authentication methods in Microsoft Entra ID?

Accepted Answer

Temporary Access Pass. Temporary Access Pass (TAP) is a valid authentication method in Microsoft Entra ID that allows users to register passwordless methods (like FIDO2 or Microsoft Authenticator) by providing a time-limited passcode. It is designed for scenarios where users have forgotten their credentials or need to onboard new devices without a password. TAP is configured via the Authentication methods policy in Entra ID and supports both one-time use and configurable lifetimes.

Answer

App registration

Answer

Managed identity

Answer

Azure AD Connect

Question 18

You need to assign the 'Security Administrator' role in Microsoft Entra ID to a user named User1. The role assignment must be eligible, and User1 must provide a justification when activating the role. What should you use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID is the only service that supports time-bound, eligible role assignments with activation justification. By configuring a PIM policy for the Security Administrator role, you can require User1 to provide a business justification before the role is activated for a specified duration.

Answer

Direct role assignment in Azure AD roles and administrators

Answer

Global Administrator role with custom activation policy

Answer

User Administrator role with access reviews

Question 19

Refer to the exhibit. You are creating a custom Azure RBAC role for a security analyst. The role as shown allows read access to storage accounts. The analyst reports that they cannot read the contents of a blob container in a storage account. Why is this?

Accepted Answer

The role does not include dataActions to read blob data.. The custom RBAC role only includes read permissions for the storage account's control plane (e.g., listing keys, reading properties) but lacks the necessary dataActions to read blob data. To read blob container contents, the role must include 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' under dataActions, which governs access to the data plane. Without this, the analyst can see the storage account but cannot access the blobs within it.

Answer

The role is not assigned to the analyst's user account.

Answer

The assignable scope is incorrect; it should be at the resource group level.

Answer

The storage account does not exist in the specified subscription.

Question 20

You need to ensure that external users who are invited to collaborate via Microsoft Entra B2B can only access the applications assigned to them. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that applies to guest users and targets the specific applications.. Option B is correct because Conditional Access policies in Microsoft Entra ID can be scoped to guest/external users and specific applications, allowing you to enforce access controls such as requiring MFA or blocking access for unapproved apps. This directly meets the requirement to restrict B2B guest users to only the applications assigned to them, without affecting other sign-in behaviors or tenant-wide settings.

Answer

Require guest users to register for MFA before accessing any applications.

Answer

Configure cross-tenant access settings to block all applications except those assigned.

Answer

Configure SharePoint external sharing settings to limit application access.

AZ-500 Practice Exam 62 — 20 Questions

Exhibit

AZ-500 Practice Exam 62 — 20 Questions

Exhibit