AZ-500 Manage identity and access — 50 Questions

Question 1

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The PIM policy has not been activated for the Global Administrator role. Microsoft Entra PIM explicitly prevents users from approving their own activation requests, even if they are members of the approver group. The scenario describes immediate activation with no approval request being sent, which indicates that the approval requirement is not being enforced. The most likely cause is that the PIM approval policy has not been activated for the Global Administrator role, so no approval workflow is triggered.

Answer

The activation approval requirement is not supported for the Global Administrator role

Answer

The user is a member of the approver group and is self-approving the request

Answer

The role activation duration is set to zero, causing immediate activation

Question 2

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require approval to activate.. Microsoft Entra PIM requires the 'Require approval to activate' setting to enforce that activation requests for a role must be approved by designated approvers before the role becomes active. This setting also automatically triggers email notifications to the configured approvers when a request is submitted, fulfilling both the approval and notification requirements.

Answer

Set the activation maximum duration to 1 hour.

Answer

Require justification on activation.

Answer

Configure notification emails for role activation.

Question 3

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the role settings for the Contributor role under the resource group in PIM. Microsoft Entra PIM allows role settings to be configured at the resource group scope. By editing the role settings for the Contributor role under that specific resource group, you can require justification (e.g., a ticket number) and set a maximum activation duration (e.g., 4 hours). These settings apply only when users activate the role for that resource group via PIM.

Answer

Create a Conditional Access policy for the Privileged Role Administrator role

Answer

Use Azure AD access reviews to review active role assignments

Answer

Modify the Azure AD tenant-wide role activation settings

Question 4

A company uses Azure AD with Premium P2 licenses. They want to require that all new users register for Azure Multi-Factor Authentication (MFA) within 14 days of their first sign-in. If they do not register, they should be denied access to all cloud applications until registration is completed. Which Azure AD feature should they configure?

Accepted Answer

Conditional Access policy targeting the MFA registration. The requirement to enforce MFA registration within a specific time frame and block access until registration is complete is achieved by configuring a Conditional Access policy targeting the 'Register security information' (MFA registration) user action. This policy can require users to register for MFA and, if not completed, deny access to all cloud apps. Microsoft Entra ID P2 licenses are required for Conditional Access.

Answer

Identity Protection user risk policy

Answer

Azure AD Identity Protection sign-in risk policy

Answer

Privileged Identity Management (PIM)

Question 5

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require approval to activate. Microsoft Entra PIM separates the requirements for activation justification and approval. To require both, you must enable 'Require justification' (so users must type a justification) and 'Require approval to activate' (so an approver from the specified security group must approve the activation). Configuring only A omits the mandatory justification requirement.

Answer

Require multi-factor authentication

Answer

Require Azure AD join

Question 6

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that are detected as having a high sign-in risk. They have created a Conditional Access policy and assigned it to all users. Which configuration should they add to the policy to trigger the block based on the sign-in risk?

Accepted Answer

Condition: Sign-in risk: High, Grant: Block access.. Microsoft Entra ID Protection assigns a risk level (Low, Medium, High) to each sign-in based on real-time signals. A Conditional Access policy can use the 'Sign-in risk' condition to evaluate this risk level and, when set to 'High', the 'Grant' control can be configured to 'Block access', which immediately prevents the sign-in from completing. This directly meets the requirement to automatically block high-risk sign-ins.

Answer

Condition: User risk: High, Grant: Block access.

Answer

Condition: Sign-in risk: High, Grant: Require multi-factor authentication.

Answer

Condition: User risk: High, Grant: Require multi-factor authentication.

Question 7

A company uses Azure AD B2B collaboration to invite external vendors. They want to restrict the vendors to only be able to access a specific application, and prevent them from discovering other users or applications in the directory. Which configuration should they apply to the external users?

Accepted Answer

Set the 'Guest user access' level to 'Guest user access is limited to properties and memberships of directory objects'. Setting the 'Guest user access' level to 'Guest user access is limited to properties and memberships of directory objects' restricts external B2B users from enumerating the full directory, including other users and applications. This configuration ensures vendors can only access the specific application they are invited to, while preventing discovery of other directory objects, which aligns with the principle of least privilege for external identities.

Answer

Configure a Conditional Access policy targeting guest users

Answer

Enable 'External Identities' cross-tenant access settings

Answer

Assign the Application User role to the vendor users

Question 8

A company uses Azure AD. They want to ensure that all users enroll in Azure Multi-Factor Authentication (MFA) within 14 days of their first sign-in. After 14 days, any user who has not enrolled must be blocked from accessing applications. Which configuration should they implement?

Accepted Answer

Create a Conditional Access policy targeting all users and all cloud apps, with the grant control 'Require multi-factor authentication registration' and configure the grace period in the MFA registration settings.. Both B and C meet the requirement. Option B uses a Conditional Access policy with 'Require multi-factor authentication registration' and configures the MFA registration grace period to 14 days. Option C enables security defaults, which also enforce MFA registration within 14 days and block users who fail to register. Option A is incorrect because Identity Protection risk policies are for risky sign-ins only. Option D is manual, not automated.

Answer

Use Azure AD Identity Protection to create a sign-in risk policy that requires MFA registration for medium and above risks.

Answer

Configure the Azure AD audit logs to send an alert when a user has not registered for MFA after 14 days, then manually block them.

Question 9

A company uses Azure AD Identity Protection and Conditional Access. They want to automatically block user access to cloud applications when Identity Protection detects that a user's sign-in risk level is high. Which configuration should they use in a Conditional Access policy?

Accepted Answer

Include 'Sign-in risk' level 'High' and set Grant to 'Block access'.. Conditional Access policies can evaluate sign-in risk levels detected by Microsoft Entra ID Protection. When the sign-in risk level is 'High', setting the Grant control to 'Block access' directly prevents the user from accessing cloud applications, meeting the requirement to automatically block access based on a high sign-in risk.

Answer

Include 'User risk' level 'High' and set Grant to 'Require multi-factor authentication'.

Answer

Include 'Device platforms' 'All' and set Grant to 'Require managed device'.

Answer

Include 'Locations' 'All trusted locations' and set Grant to 'Block access'.

Question 10

A company uses Azure AD Conditional Access. They want to block sign-ins from countries where the company does not have offices. They have a list of allowed countries. Which condition should they configure in the Conditional Access policy?

Accepted Answer

Locations. The Locations condition in Microsoft Entra Conditional Access allows you to define named locations by IP address ranges or country/region. By configuring a policy with the Locations condition set to 'All trusted locations' or a specific list of allowed countries, you can block access from all other countries. This directly meets the requirement to block sign-ins from countries without company offices.

Answer

Device platforms

Answer

Client apps

Answer

Sign-in risk

Question 11

A company wants to require that users perform multi-factor authentication (MFA) when accessing a critical enterprise application, but only when they are outside the corporate network. They have Azure Active Directory Premium P1 licenses. Which feature should they use to enforce this requirement?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID P1 allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the critical enterprise application and includes a condition for 'Locations' with 'Include' set to 'Any location' and 'Exclude' set to 'All trusted locations', you can require MFA only when users access the app from outside the corporate network. This directly meets the requirement without needing additional licensing or services.

Answer

Azure AD Identity Protection

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Application Proxy

Question 12

A security team uses Microsoft Defender for Cloud to centralize security alerts. They want to continuously export all security alerts to a Log Analytics workspace for long-term retention and custom analysis. Which two actions must be taken to achieve this? (Choose two that apply.)

Accepted Answer

Enable the continuous export feature in Microsoft Defender for Cloud.. Option A is correct because continuous export is the Microsoft Defender for Cloud capability that streams security alerts and recommendations to external targets such as a Log Analytics workspace, Event Hub, or another subscription; without enabling it, no alert data is exported. Option B is correct because, in addition to continuous export, diagnostic settings on the subscription must be configured to route the SecurityAlert (and related) log categories to the target Log Analytics workspace, which is what actually delivers the alerts for retention and custom analysis. Option C is not required because a Log Analytics workspace does not have to reside in the same region as the monitored resources; cross-region export is supported. Option D is not required because the Azure Policy definition 'Deploy export to Log Analytics workspace for Azure Security Center data' is an optional at-scale deployment mechanism, not a mandatory action for configuring continuous export.

Answer

Create a Log Analytics workspace in the same region as the resources.

Answer

Assign an Azure Policy definition for 'Deploy export to Log Analytics workspace for Azure Security Center data'.

Question 13

A security team uses Microsoft Sentinel. They want to create a custom detection rule that identifies a potential data exfiltration scenario: when a user signs in from an unusual location and then, within 30 minutes, performs a large download from Azure Blob Storage. They need to correlate sign-in logs from Azure AD with storage diagnostic logs. Which type of analytics rule should they create in Microsoft Sentinel?

Accepted Answer

A scheduled query rule using KQL. A scheduled query rule is correct because it allows you to write a KQL query that joins Microsoft Entra ID sign-in logs (SigninLogs) with Azure Storage diagnostic logs (StorageBlobLogs) based on a user identifier, and then uses a time window (e.g., 30 minutes) to correlate the two events. This is the only rule type that supports custom KQL logic for multi-table joins and time-based correlation, which is essential for detecting the described exfiltration pattern.

Answer

An NRT (near-real-time) rule

Answer

A fusion rule

Answer

A machine learning-based analytics rule

Question 14

A security team wants to use Microsoft Sentinel to detect potential data exfiltration events from Azure Blob Storage. Which two logs should they ingest to best identify unauthorized read access and data transfer activities? (Choose two.)

Accepted Answer

Storage account audit logs (e.g., StorageReadKey, GetBlob). Storage account audit logs (e.g., StorageReadKey, GetBlob) capture detailed data-plane operations, including read access to blobs and keys, which directly indicates potential data exfiltration. Option B is correct because the Azure Activity log for storage account write operations records management-plane events like storage account key regeneration, which can be used to bypass existing access controls and exfiltrate data. Together, these logs provide visibility into both the data access and the administrative actions that could enable exfiltration.

Answer

Azure AD sign-in logs

Answer

Azure Key Vault audit logs

Question 15

A security operations team uses Microsoft Sentinel for security monitoring. They want to automatically create an incident and send an email to the on-call security engineer when a specific event occurs in Azure Activity Log, such as someone disabling a key vault firewall. Which automation feature should they configure?

Accepted Answer

Automation rules. Automation rules are the correct feature because they can automatically create an incident when a specific alert is generated and can invoke a playbook to send an email to the on-call engineer. Playbooks alone cannot create incidents; they only execute workflows after an alert/incident already exists.

Answer

Playbooks (Azure Logic Apps)

Answer

Scheduled analytics rules

Answer

Livestream

Question 16

A security team uses Microsoft Defender for Cloud. They have enabled the integrated vulnerability assessment (VA) solution on their Azure virtual machines. They want to receive alerts when a VM has a vulnerability rated 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated Qualys-based vulnerability assessment (VA) solution that continuously scans Azure VMs for vulnerabilities and provides security alerts when critical vulnerabilities are found. Plan 1 only offers basic threat detection and does not include the integrated VA scanner or the ability to generate alerts based on VA findings.

Answer

Defender for Servers Plan 1

Answer

Defender for Cloud Apps

Answer

Defender for Storage

Question 17

A company uses Microsoft Defender for Cloud to protect their Azure virtual machines. They have enabled the integrated vulnerability assessment (VA) solution on all VMs. The security team wants to receive an alert when a VM is found to have a vulnerability rated as 'Critical' by the VA solution. Which Defender for Cloud plan must be enabled on the subscription?

Accepted Answer

Defender for Servers Plan 2. Defender for Servers Plan 2 is required because it includes the integrated vulnerability assessment (VA) solution powered by Qualys, which provides continuous scanning and alerts for critical vulnerabilities. Plan 1 only offers basic threat detection and does not include the VA solution or the ability to generate alerts based on vulnerability severity ratings.

Answer

Defender for Servers Plan 1

Answer

Defender for SQL

Answer

Defender for App Service

Question 18

A security analyst uses Microsoft Defender for Cloud. They need to automatically apply a specific remediation action (e.g., enable audit logging) to a set of Azure SQL servers that are found to be non-compliant with a security policy. Which Defender for Cloud feature should they use?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger Logic Apps based on security alerts or policy compliance changes. By configuring a workflow automation rule that triggers on the 'Non-compliant resource' condition for the specific Azure SQL servers, you can automatically invoke a remediation action, such as enabling audit logging, without manual intervention.

Answer

Continuous export

Answer

Alert suppression rules

Answer

Regulatory compliance dashboard

Question 19

A company uses Microsoft Defender for Cloud. They want to automatically apply a security recommendation (such as enabling encryption on storage accounts) to all existing resources that are found to be non-compliant without manual intervention. Which Defender for Cloud feature should they configure?

Accepted Answer

Workflow automation. Workflow automation in Microsoft Defender for Cloud allows you to trigger automated actions (e.g., Azure Logic Apps) based on security recommendations or regulatory compliance changes. By configuring a workflow automation rule that triggers on the 'recommendation' event for a specific recommendation (like 'Storage accounts should use customer-managed key for encryption'), you can automatically remediate non-compliant resources without manual intervention, for example by invoking a Logic App that enables encryption on the storage account.

Answer

Continuous export

Answer

Email notifications

Answer

Security policies

Question 20

A security analyst uses Microsoft Sentinel. They want to create a rule that triggers an incident when a user is added to a highly privileged Azure AD role (e.g., Global Administrator). The data source is Azure AD audit logs. Which type of analytics rule should they create?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because Microsoft Entra ID audit logs are ingested into Log Analytics and scheduled queries run on a defined interval (e.g., every 5 minutes) to detect patterns like role assignments. This rule type allows you to write a KQL query against the AuditLogs table to identify when a user is added to a highly privileged role, then map the results to an incident. While NRT rules can also query AuditLogs and provide lower latency, they are intended for high-frequency, time-sensitive detections and may have limitations on query complexity (e.g., no joins). For this scenario, a scheduled query is the standard and recommended approach.

Answer

Near-real-time (NRT) rule

Answer

Fusion rule

Answer

Microsoft Security incident creation rule