AZ-500 Manage identity and access Practice Test 2 — 15 Questions

Question 1

A company wants to ensure that users can only access Microsoft 365 services (e.g., Exchange Online, SharePoint Online) from devices that are confirmed to be compliant with corporate security policies (e.g., encryption enabled, antivirus active). Which Azure AD policy type should they create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policy with the 'Require compliant device' grant control.. A is correct because a Conditional Access policy with the 'Require compliant device' grant control enforces device-based access restrictions by checking the device's compliance status reported by Microsoft Intune. This ensures that only devices meeting corporate security policies (e.g., encryption enabled, antivirus active) can access Microsoft 365 services like Exchange Online and SharePoint Online.

Answer

Identity Protection policy with a sign-in risk policy.

Answer

Access review policy for groups.

Answer

Privileged Identity Management (PIM) activation policy.

Question 2

A company uses Azure AD. They want to ensure that all users enroll in Azure Multi-Factor Authentication (MFA) within 14 days of their first sign-in. After 14 days, any user who has not enrolled must be blocked from accessing applications. Which configuration should they implement?

Accepted Answer

Create a Conditional Access policy targeting all users and all cloud apps, with the grant control 'Require multi-factor authentication registration' and configure the grace period in the MFA registration settings.. Both B and C meet the requirement. Option B uses a Conditional Access policy with 'Require multi-factor authentication registration' and configures the MFA registration grace period to 14 days. Option C enables security defaults, which also enforce MFA registration within 14 days and block users who fail to register. Option A is incorrect because Identity Protection risk policies are for risky sign-ins only. Option D is manual, not automated.

Answer

Use Azure AD Identity Protection to create a sign-in risk policy that requires MFA registration for medium and above risks.

Answer

Configure the Azure AD audit logs to send an alert when a user has not registered for MFA after 14 days, then manually block them.

Question 3

A company uses Azure Active Directory and has guest users invited via B2B collaboration. The security team wants to require that all guest users from specific external organizations must complete multi-factor authentication (MFA) when accessing the company's SaaS applications. Which Conditional Access policy configuration should they use?

Accepted Answer

Create a policy that applies to 'Guest or external users' with a condition for 'External tenants' specifying the organizations, and a grant control of 'Require multi-factor authentication'.. It uses the 'External tenants' condition within a Conditional Access policy targeting 'Guest or external users' to specify the exact organizations from which guests must complete MFA. This directly meets the requirement to scope MFA enforcement to specific external organizations, not all guests. The 'Require multi-factor authentication' grant control ensures MFA is enforced for those guests when accessing SaaS applications.

Answer

Create a policy that applies to 'All users' with a condition for 'Guest or external users' and a grant control of 'Require multi-factor authentication'.

Answer

Create a policy that applies to 'All guest users' and assign it to the SaaS applications. Use a session control 'Use app enforced restrictions'.

Answer

Create a policy that applies to 'Guest or external users' with a condition for 'Sign-in risk' set to 'Medium and above' and a grant control of 'Block access'.

Question 4

A company uses Azure AD Identity Protection and Conditional Access. They want to automatically block user access to cloud applications when Identity Protection detects that a user's sign-in risk level is high. Which configuration should they use in a Conditional Access policy?

Accepted Answer

Include 'Sign-in risk' level 'High' and set Grant to 'Block access'.. Conditional Access policies can evaluate sign-in risk levels detected by Azure AD Identity Protection. When the sign-in risk level is 'High', setting the Grant control to 'Block access' directly prevents the user from accessing cloud applications, meeting the requirement to automatically block access based on a high sign-in risk.

Answer

Include 'User risk' level 'High' and set Grant to 'Require multi-factor authentication'.

Answer

Include 'Device platforms' 'All' and set Grant to 'Require managed device'.

Answer

Include 'Locations' 'All trusted locations' and set Grant to 'Block access'.

Question 5

A company uses Azure AD Conditional Access. They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but only when the sign-in risk level is medium or above. Which configuration should they use in the Conditional Access policy?

Accepted Answer

Assignments > Cloud apps > Include > Microsoft Azure Management, Conditions > Sign-in risk > Medium and above, Grant > Require MFA.. It specifically targets the Azure portal via 'Microsoft Azure Management' in Cloud apps, sets the sign-in risk condition to 'Medium and above', and requires MFA. This matches the requirement exactly: MFA is triggered only when accessing the Azure portal and the sign-in risk level is medium or higher.

Answer

Assignments > Users > All users, Cloud apps > All cloud apps, Conditions > User risk > Medium, Grant > Require MFA.

Answer

Assignments > Conditions > Locations > All trusted locations, Grant > Require MFA.

Answer

Assignments > Cloud apps > Include > All cloud apps, Conditions > Device platforms > iOS, Grant > Require MFA.

Question 6

A company uses Azure AD Privileged Identity Management (PIM) for the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a justification, and the activation requires approval from a designated security group. Which PIM role settings should they configure?

Accepted Answer

Require justification on activation (Yes), Require approval (Yes), Select approver(s) (the security group).. PIM role settings allow administrators to enforce both justification and approval workflows for role activation. Setting 'Require justification on activation' to 'Yes' ensures the user provides a reason, and setting 'Require approval' to 'Yes' with the designated security group as the approver enforces the approval requirement. This combination directly meets the company's stated requirements.

Answer

Require justification on activation (No), Require approval (Yes), Select approver(s) (the security group).

Answer

Expiration > Maximum activation duration (4 hours).

Answer

On activation, require Azure MFA registration.

Question 7

A company wants to allow external business partners to access specific SharePoint Online sites using their own corporate credentials. They do not want to manage partner accounts in their own Azure AD tenant. Which Azure AD feature should they use?

Accepted Answer

Azure AD External Identities. Azure AD External Identities (specifically B2B collaboration) allows you to invite external business partners to access your SharePoint Online sites using their own corporate credentials (their home Azure AD or identity provider). This eliminates the need to manage partner accounts in your tenant, as identities remain in their home directory and are authenticated via federation or SAML/WS-Fed protocols.

Answer

Azure AD B2C

Answer

Conditional Access

Answer

Privileged Identity Management

Question 8

A company uses Azure Active Directory (Azure AD) and wants to regularly review the membership of a group that grants access to a critical application. Each member must attest their continued need for access. Which Azure AD feature should they use?

Accepted Answer

Azure AD Identity Governance access reviews. Azure AD Identity Governance access reviews enable administrators to create recurring reviews of group memberships, requiring each member to attest their continued need for access. This directly addresses the requirement for regular attestation of group membership for a critical application, as it automates the review process and ensures compliance.

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Conditional Access

Answer

Azure AD Identity Protection

Question 9

A company has Azure AD with Premium P2 licenses. They want to enforce Azure Multi-Factor Authentication (MFA) for all users accessing the Azure portal from untrusted networks, but only after the user has successfully entered their password. Which Conditional Access grant control should they configure?

Accepted Answer

Require multi-factor authentication. The 'Require multi-factor authentication' grant control in Conditional Access enforces MFA after password authentication, which aligns with the requirement to prompt for MFA only after the user has successfully entered their password. This control is applied based on the condition of 'untrusted networks' (e.g., using the 'Locations' condition to target all locations except trusted IPs), ensuring that MFA is triggered specifically for Azure portal access from untrusted networks.

Answer

Require device to be marked as compliant

Answer

Require approved client app

Answer

Require domain join

Question 10

A company uses Azure AD Conditional Access. They need to restrict access to a cloud application such that users with unmanaged devices can only view data but cannot download it. Which Conditional Access session control should they enable?

Accepted Answer

Use Conditional Access App Control. Conditional Access App Control (Microsoft Defender for Cloud Apps) provides session-level controls that can enforce restrictions like 'Block Download' based on device compliance. This allows administrators to apply policies that restrict data exfiltration from unmanaged devices while still permitting read-only access to the cloud application.

Answer

Sign-in frequency

Answer

Session persistence

Answer

Application consent policy

Question 11

A company uses Azure AD Conditional Access. They want to block sign-ins from countries where the company does not have offices. They have a list of allowed countries. Which condition should they configure in the Conditional Access policy?

Accepted Answer

Locations. The Locations condition in Azure AD Conditional Access allows you to define named locations by IP address ranges or country/region. By configuring a policy with the Locations condition set to 'All trusted locations' or a specific list of allowed countries, you can block access from all other countries. This directly meets the requirement to block sign-ins from countries without company offices.

Answer

Device platforms

Answer

Client apps

Answer

Sign-in risk

Question 12

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want a user to be able to activate this role for a maximum of 2 hours per activation. Which PIM setting should they configure?

Accepted Answer

Set the 'Activation maximum duration' to 2 hours in the role settings for Security Administrator.. The 'Activation maximum duration' setting in Azure AD PIM role settings directly controls the maximum time a user can remain active in an eligible role after activation. By setting this to 2 hours, the user will be able to activate the Security Administrator role for up to 2 hours per activation, after which the role assignment expires automatically.

Answer

Set the 'Expire eligible assignments after' to 2 hours in the role settings.

Answer

Enable 'Require justification' and 'Require approval' to ensure the role is not misused.

Answer

Set the 'Activation maximum duration' to 1 hour and the user can activate twice.

Question 13

A company wants to require that users perform multi-factor authentication (MFA) when accessing a critical enterprise application, but only when they are outside the corporate network. They have Azure Active Directory Premium P1 licenses. Which feature should they use to enforce this requirement?

Accepted Answer

Conditional Access policy. Conditional Access policies in Azure AD Premium P1 allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the critical enterprise application and includes a condition for 'Locations' with 'Include' set to 'Any location' and 'Exclude' set to 'All trusted locations', you can require MFA only when users access the app from outside the corporate network. This directly meets the requirement without needing additional licensing or services.

Answer

Azure AD Identity Protection

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Application Proxy

Question 14

A company uses Azure AD Privileged Identity Management (PIM) for Azure AD roles. They want to require that users must perform multi-factor authentication (MFA) when activating a role. Which PIM setting should they configure?

Accepted Answer

Require Azure AD Multi-Factor Authentication on activation. To enforce multi-factor authentication during role activation in Azure AD Privileged Identity Management (PIM), you must configure the 'Require Azure AD Multi-Factor Authentication on activation' setting. This ensures that before a user’s role assignment is activated, they must complete an MFA challenge, adding an extra layer of security against unauthorized access.

Answer

Require approval to activate

Answer

Require justification on activation

Answer

Require ticket information on activation

Question 15

A security team uses Microsoft Defender for Cloud to centralize security alerts. They want to continuously export all security alerts to a Log Analytics workspace for long-term retention and custom analysis. Which two actions must be taken to achieve this? (Choose two that apply.)

Accepted Answer

Enable the continuous export feature in Microsoft Defender for Cloud.. The continuous export feature in Microsoft Defender for Cloud enables streaming of security alerts to a Log Analytics workspace. Option B is also correct because you need to configure diagnostic settings on the subscription to specify the SecurityAlert log category and the destination workspace. Both actions are necessary: enabling continuous export activates the capability at the Defender level, while diagnostic settings define the actual log routing. Options C and D are not required manual actions; the workspace region is flexible, and the Azure Policy is an automation tool, not a manual step.

Answer

Create a Log Analytics workspace in the same region as the resources.

Answer

Assign an Azure Policy definition for 'Deploy export to Log Analytics workspace for Azure Security Center data'.