AZ-500 Manage identity and access Practice Test 3 — 15 Questions

Question 1

A company has a subscription with Azure Active Directory (Azure AD). They want to enable a conditional access policy that requires all users to use multi-factor authentication (MFA) when accessing the Azure portal. The policy should only apply to users who are members of a group called 'AllUsers'. Which assignment should they configure in the policy?

Accepted Answer

Assign the 'AllUsers' group to the 'Users' section and select 'Azure portal' as the cloud app. Option B is correct because in an Azure AD Conditional Access policy, the 'Users' section is where you specify which users or groups the policy applies to, and the 'Cloud apps' section is where you select the target application (Azure portal). By assigning the 'AllUsers' group to 'Users' and selecting 'Azure portal' as the cloud app, the policy enforces MFA for all members of that group when they access the Azure portal.

Answer

Assign the 'AllUsers' group to the 'Cloud apps' section and select 'Azure portal' as the application

Answer

Add a condition for 'Client apps' specifying 'Browser' only

Answer

Create two policies: one for users and one for the Azure portal

Question 2

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that activation of this role must be approved by a designated group of security engineers before it becomes active. Which PIM role setting should they configure?

Accepted Answer

Require approval. Option C is correct because Azure AD PIM's 'Require approval' setting enforces that a designated group of approvers must authorize each activation request before the role becomes active. This directly meets the requirement for approval by security engineers, ensuring that role activation is gated by explicit consent rather than being automatic.

Answer

Activation maximum duration (hours)

Answer

MFA on activation

Answer

Require justification on activation

Question 3

A company uses Azure AD. They want to ensure that all users enroll in Azure Multi-Factor Authentication (MFA) within 14 days of their first sign-in. After 14 days, any user who has not enrolled must be blocked from accessing applications. Which configuration should they implement?

Accepted Answer

Create a Conditional Access policy targeting all users and all cloud apps, with the grant control 'Require multi-factor authentication registration' and configure the grace period in the MFA registration settings.. Option B is correct because it combines a Conditional Access policy requiring MFA registration with a configured grace period in the MFA registration settings. The 'Require multi-factor authentication registration' grant control forces users to register during sign-in, and the grace period (set in the MFA service settings) allows up to 14 days before blocking access. This meets the requirement to block unregistered users after 14 days.

Answer

Use Azure AD Identity Protection to create a sign-in risk policy that requires MFA registration for medium and above risks.

Answer

Enable security defaults for the directory.

Answer

Configure the Azure AD audit logs to send an alert when a user has not registered for MFA after 14 days, then manually block them.

Question 4

A company uses Azure Active Directory and has guest users invited via B2B collaboration. The security team wants to require that all guest users from specific external organizations must complete multi-factor authentication (MFA) when accessing the company's SaaS applications. Which Conditional Access policy configuration should they use?

Accepted Answer

Create a policy that applies to 'Guest or external users' with a condition for 'External tenants' specifying the organizations, and a grant control of 'Require multi-factor authentication'.. Option B is correct because it uses the 'External tenants' condition within a Conditional Access policy targeting 'Guest or external users' to specify the exact organizations from which guests must complete MFA. This directly meets the requirement to scope MFA enforcement to specific external organizations, not all guests. The 'Require multi-factor authentication' grant control ensures MFA is enforced for those guests when accessing SaaS applications.

Answer

Create a policy that applies to 'All users' with a condition for 'Guest or external users' and a grant control of 'Require multi-factor authentication'.

Answer

Create a policy that applies to 'All guest users' and assign it to the SaaS applications. Use a session control 'Use app enforced restrictions'.

Answer

Create a policy that applies to 'Guest or external users' with a condition for 'Sign-in risk' set to 'Medium and above' and a grant control of 'Block access'.

Question 5

A company uses Azure AD Identity Protection and Conditional Access. They want to automatically block user access to cloud applications when Identity Protection detects that a user's sign-in risk level is high. Which configuration should they use in a Conditional Access policy?

Accepted Answer

Include 'Sign-in risk' level 'High' and set Grant to 'Block access'.. Option B is correct because Conditional Access policies can evaluate sign-in risk levels detected by Azure AD Identity Protection. When the sign-in risk level is 'High', setting the Grant control to 'Block access' directly prevents the user from accessing cloud applications, meeting the requirement to automatically block access based on a high sign-in risk.

Answer

Include 'User risk' level 'High' and set Grant to 'Require multi-factor authentication'.

Answer

Include 'Device platforms' 'All' and set Grant to 'Require managed device'.

Answer

Include 'Locations' 'All trusted locations' and set Grant to 'Block access'.

Question 6

A company uses Azure AD Conditional Access. They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but only when the sign-in risk level is medium or above. Which configuration should they use in the Conditional Access policy?

Accepted Answer

Assignments > Cloud apps > Include > Microsoft Azure Management, Conditions > Sign-in risk > Medium and above, Grant > Require MFA.. Option A is correct because it specifically targets the Azure portal via 'Microsoft Azure Management' in Cloud apps, sets the sign-in risk condition to 'Medium and above', and requires MFA. This matches the requirement exactly: MFA is triggered only when accessing the Azure portal and the sign-in risk level is medium or higher.

Answer

Assignments > Users > All users, Cloud apps > All cloud apps, Conditions > User risk > Medium, Grant > Require MFA.

Answer

Assignments > Conditions > Locations > All trusted locations, Grant > Require MFA.

Answer

Assignments > Cloud apps > Include > All cloud apps, Conditions > Device platforms > iOS, Grant > Require MFA.

Question 7

A company uses Azure AD Privileged Identity Management (PIM) for the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a justification, and the activation requires approval from a designated security group. Which PIM role settings should they configure?

Accepted Answer

Require justification on activation (Yes), Require approval (Yes), Select approver(s) (the security group).. Option A is correct because PIM role settings allow administrators to enforce both justification and approval workflows for role activation. Setting 'Require justification on activation' to 'Yes' ensures the user provides a reason, and setting 'Require approval' to 'Yes' with the designated security group as the approver enforces the approval requirement. This combination directly meets the company's stated requirements.

Answer

Require justification on activation (No), Require approval (Yes), Select approver(s) (the security group).

Answer

Expiration > Maximum activation duration (4 hours).

Answer

On activation, require Azure MFA registration.

Question 8

A company wants to allow external business partners to access specific SharePoint Online sites using their own corporate credentials. They do not want to manage partner accounts in their own Azure AD tenant. Which Azure AD feature should they use?

Accepted Answer

Azure AD External Identities. Azure AD External Identities (specifically B2B collaboration) allows you to invite external business partners to access your SharePoint Online sites using their own corporate credentials (their home Azure AD or identity provider). This eliminates the need to manage partner accounts in your tenant, as identities remain in their home directory and are authenticated via federation or SAML/WS-Fed protocols.

Answer

Azure AD B2C

Answer

Conditional Access

Answer

Privileged Identity Management

Question 9

A company uses Azure Active Directory (Azure AD) and wants to regularly review the membership of a group that grants access to a critical application. Each member must attest their continued need for access. Which Azure AD feature should they use?

Accepted Answer

Azure AD Identity Governance access reviews. Azure AD Identity Governance access reviews enable administrators to create recurring reviews of group memberships, requiring each member to attest their continued need for access. This directly addresses the requirement for regular attestation of group membership for a critical application, as it automates the review process and ensures compliance.

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Conditional Access

Answer

Azure AD Identity Protection

Question 10

A company has Azure AD with Premium P2 licenses. They want to enforce Azure Multi-Factor Authentication (MFA) for all users accessing the Azure portal from untrusted networks, but only after the user has successfully entered their password. Which Conditional Access grant control should they configure?

Accepted Answer

Require multi-factor authentication. Option A is correct because the 'Require multi-factor authentication' grant control in Conditional Access enforces MFA after password authentication, which aligns with the requirement to prompt for MFA only after the user has successfully entered their password. This control is applied based on the condition of 'untrusted networks' (e.g., using the 'Locations' condition to target all locations except trusted IPs), ensuring that MFA is triggered specifically for Azure portal access from untrusted networks.

Answer

Require device to be marked as compliant

Answer

Require approved client app

Answer

Require domain join

Question 11

A company develops a web application that runs on Azure App Service. The application needs to access Azure Key Vault to retrieve secrets. The security team wants to avoid using service principals or connection strings. Which identity should they assign to the App Service to authenticate to Key Vault?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it provides an automatically managed identity in Azure AD, directly tied to the App Service resource, without requiring any credentials to be stored or rotated. This allows the App Service to authenticate to Key Vault using Azure AD tokens, eliminating the need for service principals or connection strings. The security team's requirement to avoid service principals or connection strings is fully met, as the identity is managed entirely by Azure.

Answer

User-assigned managed identity

Answer

Azure AD application registration with a client secret

Answer

Azure AD service principal with certificate-based authentication

Question 12

A company uses Azure AD Conditional Access. They need to restrict access to a cloud application such that users with unmanaged devices can only view data but cannot download it. Which Conditional Access session control should they enable?

Accepted Answer

Use Conditional Access App Control. Option B is correct because Conditional Access App Control (Microsoft Defender for Cloud Apps) provides session-level controls that can enforce restrictions like 'Block Download' based on device compliance. This allows administrators to apply policies that restrict data exfiltration from unmanaged devices while still permitting read-only access to the cloud application.

Answer

Sign-in frequency

Answer

Session persistence

Answer

Application consent policy

Question 13

A company uses Azure AD Conditional Access. They want to block sign-ins from countries where the company does not have offices. They have a list of allowed countries. Which condition should they configure in the Conditional Access policy?

Accepted Answer

Locations. The Locations condition in Azure AD Conditional Access allows you to define named locations by IP address ranges or country/region. By configuring a policy with the Locations condition set to 'All trusted locations' or a specific list of allowed countries, you can block access from all other countries. This directly meets the requirement to block sign-ins from countries without company offices.

Answer

Device platforms

Answer

Client apps

Answer

Sign-in risk

Question 14

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want a user to be able to activate this role for a maximum of 2 hours per activation. Which PIM setting should they configure?

Accepted Answer

Set the 'Activation maximum duration' to 2 hours in the role settings for Security Administrator.. Option A is correct because the 'Activation maximum duration' setting in Azure AD PIM role settings directly controls the maximum time a user can remain active in an eligible role after activation. By setting this to 2 hours, the user will be able to activate the Security Administrator role for up to 2 hours per activation, after which the role assignment expires automatically.

Answer

Set the 'Expire eligible assignments after' to 2 hours in the role settings.

Answer

Enable 'Require justification' and 'Require approval' to ensure the role is not misused.

Answer

Set the 'Activation maximum duration' to 1 hour and the user can activate twice.

Question 15

A company wants to require that users perform multi-factor authentication (MFA) when accessing a critical enterprise application, but only when they are outside the corporate network. They have Azure Active Directory Premium P1 licenses. Which feature should they use to enforce this requirement?

Accepted Answer

Conditional Access policy. Conditional Access policies in Azure AD Premium P1 allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the critical enterprise application and includes a condition for 'Locations' set to 'All trusted locations' (or 'Not trusted locations'), you can require MFA only when users access the app from outside the corporate network. This directly meets the requirement without needing additional licensing or services.

Answer

Azure AD Identity Protection

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Application Proxy