AZ-500 Manage identity and access Practice Test 3 — 15 Questions

Question 1

A Conditional Access policy should reduce account takeover risk for administrators without blocking normal low-risk access. Which two signals or controls are most appropriate?

Accepted Answer

Require phishing-resistant MFA or strong authentication for privileged roles. Requiring phishing-resistant MFA (e.g., FIDO2 security keys or certificate-based authentication) for privileged roles directly mitigates account takeover by preventing credential theft and replay attacks. This aligns with the principle of using strong authentication for high-value accounts, as specified in Microsoft's Conditional Access guidance for administrators.

Answer

Allow legacy authentication for administrator accounts

Answer

Exclude all Global Administrators from the policy

Question 2

A security team is reviewing risky OAuth applications in Microsoft Entra ID. Which two actions reduce future consent risk?

Accepted Answer

Restrict user consent to verified publishers and low-risk permissions. Restricting user consent to verified publishers and low-risk permissions reduces the likelihood of users approving malicious or overly permissive OAuth apps. This policy, configured in Microsoft Entra ID (Azure AD), ensures that only apps from verified publishers requesting low-risk permissions can be consented to by users, thereby mitigating consent-based attacks like OAuth consent phishing.

Answer

Grant tenant-wide admin consent to all existing apps

Answer

Delete all enterprise applications including Microsoft first-party apps

Question 3

A Sentinel detection should enrich alerts with business-critical asset context. Which two mechanisms are appropriate?

Accepted Answer

Join the query with a watchlist of critical assets. Watchlists in Microsoft Sentinel allow you to store and reference a curated set of critical asset identifiers (e.g., hostnames, IPs, account SIDs). By joining your analytics rule query with a watchlist, you can automatically enrich alerts with business-critical context, ensuring that incidents involving high-value assets are flagged with additional metadata. Option C is correct because mapping entities like Host, Account, and IP in the analytics rule definition enables Sentinel to extract and normalize these identifiers from raw log fields, which then allows playbooks, investigations, and threat intelligence to correlate alerts with asset context.

Answer

Delete low-severity incidents automatically

Answer

Disable all built-in analytics templates

Question 4

You are configuring Azure AD Conditional Access policies for a company that uses Microsoft Intune for mobile device management. Which three of the following conditions can be used to enforce access controls in a Conditional Access policy? (Choose three.)

Accepted Answer

Device compliance status. Device compliance status is a correct condition because Conditional Access can evaluate whether a device is marked as compliant by Intune. User sign-in risk level is correct as it leverages Microsoft Entra ID Protection to detect anomalous sign-in behavior. Network location based on public IP address is correct because Conditional Access can restrict access to known IP ranges. Application sensitivity labels is not a condition; sensitivity labels are used with Microsoft Information Protection for document-level controls, not as a trigger for Conditional Access policies.

Answer

Azure AD role membership

Answer

Network location based on public IP address

Answer

Operating system version of the client device

Question 5

Your organization uses Azure AD Privileged Identity Management (PIM) to manage admin roles. Which three of the following are valid configurations for role activation? (Choose three.)

Accepted Answer

Require Azure AD Multi-Factor Authentication (MFA) during activation. Microsoft Entra PIM allows organizations to enforce just-in-time (JIT) access for privileged roles. Requiring Microsoft Entra ID MFA during activation ensures the user's identity is verified before role elevation. Setting a maximum activation duration (e.g., 1–8 hours) limits the window of elevated privilege. Requiring approval from designated approvers adds a secondary authorization layer, preventing unauthorized or accidental role assignments.

Answer

Require a ticket number from an external ticketing system

Answer

Disable activation during weekends

Answer

Automatically assign the role without activation

Question 6

You are designing an Azure RBAC role assignment strategy for a subscription. Which three of the following practices are recommended for secure role management? (Choose three.)

Accepted Answer

Use custom roles with the least privilege principle when built-in roles are too permissive. Assigning roles at the management group level reduces the number of assignments because permissions are inherited by all child subscriptions, simplifying management and reducing the risk of misconfiguration. Using custom roles with the least privilege principle ensures that users have only the permissions they need when built-in roles are too broad, minimizing the attack surface. Assigning roles to Microsoft Entra ID groups rather than individual users enables centralized management of permissions through group membership, making it easier to audit and update access without modifying role assignments directly.

Answer

Create multiple role assignments for the same scope to the same user

Answer

Use the User Access Administrator role to grant users access to resources

Answer

Assign the Contributor role at the resource group level for all developers

Question 7

Your company is implementing an Azure AD B2B collaboration strategy for external partners. Which three of the following statements about Azure AD B2B collaboration are correct? (Choose three.)

Accepted Answer

External users can use their own Azure AD or Microsoft account to sign in. Microsoft Entra B2B collaboration allows external users to sign in using their own Microsoft Entra ID, Microsoft account (e.g., Outlook.com), or other identity providers (e.g., Google, SAML/WS-Fed IdPs). These users are represented as guest user objects in the tenant directory, which enables them to be managed like internal users. Conditional Access policies can be applied to guest users at the tenant or application level, allowing organizations to enforce MFA, device compliance, or sign-in risk policies for external collaborators.

Answer

Azure AD B2B collaboration requires an Azure AD Premium P2 license for each guest user

Answer

External users must have an Azure AD tenant in their own organization

Answer

Guest users cannot access SharePoint Online sites

Question 8

You are a security engineer for a global enterprise that uses Microsoft Entra ID (formerly Azure Active Directory). The company requires that all administrative access to Azure resources be secured using Privileged Identity Management (PIM) and that access reviews are conducted regularly. You need to implement a solution that meets the following requirements:
- Administrators must be able to activate their roles only during approved time windows.
- All role activations must require Azure AD Multi-Factor Authentication (MFA).
- Role activations must be limited to a maximum of 4 hours.
- Access reviews must be performed every 90 days for all privileged roles.
Which four of the following actions should you take to meet the requirements? (Choose four.)

Accepted Answer

In PIM settings for each privileged role, set the activation maximum duration to 4 hours.. Configuring the activation maximum duration to 4 hours in PIM settings directly enforces the requirement that role activations are limited to a maximum of 4 hours. Requiring Microsoft Entra ID MFA on activation in PIM settings ensures that all role activations are protected by MFA. Configuring an access review every 90 days for privileged roles meets the access review requirement. Defining an approval workflow with a time window for activation in PIM settings allows administrators to activate roles only during approved time windows, fulfilling that specific requirement.

Answer

Create an Entra ID Conditional Access policy that requires MFA for all users when accessing Azure Resource Manager.

Answer

Configure a role-assignable group in Entra ID and add it to the privileged role.

Question 9

Match each Azure security feature to its description.

Accepted Answer

Azure Security Center: Provides unified security management and advanced threat protection across hybrid cloud workloads.. Core Azure security services: Azure Security Center (unified security management), Azure Sentinel (SIEM/SOAR), Azure Key Vault (key/secret management), Azure Firewall (network security), and Azure DDoS Protection (DDoS defense). Common confusions involve mixing up definitions, especially between Security Center and Firewall, and between Sentinel and Key Vault.

Answer

Azure Sentinel: Used to safeguard cryptographic keys and secrets used by cloud applications and services.

Answer

Azure Firewall: Provides unified security management and advanced threat protection across hybrid cloud workloads.

Question 10

Match each Azure AD authentication method to its description.

Accepted Answer

Password Hash Synchronization: Synchronizes password hashes from on-premises AD to Azure AD for authentication. Password Hash Synchronization syncs hashes; Pass-through Authentication validates on-premises; Federation (AD FS) uses on-premises federation service; Microsoft Entra ID Seamless SSO provides silent sign-on. Common confusions involve swapping PHS and PTA definitions.

Answer

Password Hash Synchronization: Validates passwords directly against on-premises Active Directory without storing hashes in the cloud

Answer

Pass-through Authentication: Synchronizes password hashes from on-premises AD to Azure AD for authentication

Question 11

Match each Azure Security Center tier to its capabilities.

Accepted Answer

Free: Basic security policies and recommendations. Azure Security Center offers two tiers: Free (basic assessment and recommendations) and Standard/Azure Defender (advanced threat protection, alerts, and just-in-time access). Common confusions involve swapping the capabilities of each tier.

Answer

Free: Advanced threat detection and response

Answer

Standard (Azure Defender): Basic security policies and recommendations

Question 12

Match each Azure AD Conditional Access component to its role.

Accepted Answer

User and group assignments: Specify the users and groups that the policy applies to.. In Microsoft Entra Conditional Access, User and group assignments target identities, Cloud app assignments target apps, and Conditions define environmental signals. Grant controls enforce actions like MFA. Common confusions involve mixing these roles.

Answer

User and group assignments: Define conditions such as location and device state.

Answer

Cloud app assignments: Enforce access controls like requiring multi-factor authentication.

Answer

Grant controls: Specify the cloud applications that the policy applies to.

Question 13

You are managing a Microsoft Entra ID tenant that has Microsoft Entra ID P2 licenses. The security team wants to enforce that when users access the Azure portal, they must use a compliant device. However, they also want to allow users to access the Azure portal from personal devices if they use multi-factor authentication and the sign-in risk is low. What should you configure to meet these requirements?

Accepted Answer

Create two Conditional Access policies: one that requires compliant devices for all users, and another that requires MFA and allows access only for low sign-in risk, with the first policy excluding low-risk sign-ins.. The correct configuration involves two Conditional Access policies: one that enforces compliant devices for all users but excludes low-risk sign-ins, and another that applies to low-risk sign-ins and requires MFA. This allows personal devices to access the Azure portal only when MFA is used and risk is low, while other sign-ins must come from compliant devices. This meets both security and flexibility requirements.

Answer

Configure a Conditional Access policy that requires compliant devices, and use Microsoft Entra ID Protection to require MFA for low-risk sign-ins.

Answer

Create a single Conditional Access policy that requires compliant devices and MFA, with a condition to exclude low sign-in risk.

Answer

Create a Conditional Access policy that requires compliant devices and MFA, and set the policy to report-only mode to monitor the impact.

Question 14

You are an Azure Security Engineer for a company that uses Microsoft Entra ID. The company has a custom line-of-business application that needs to access Microsoft Graph API to read user profiles. The application runs on an Azure virtual machine and must authenticate without storing credentials in code or configuration files. You need to configure the application to use a managed identity. Which type of managed identity should you use, and how should you grant permissions?

Accepted Answer

Use a system-assigned managed identity for the virtual machine, and grant the required Microsoft Graph API permissions to the managed identity's service principal.. A system-assigned managed identity is created on the VM and tied to its lifecycle. The application uses the instance metadata service to obtain tokens for Microsoft Graph. Permissions are granted by assigning the required API permissions to the managed identity's service principal in Microsoft Entra ID. This avoids storing any credentials in code or configuration, satisfying the requirement.

Answer

Use a user-assigned managed identity for the virtual machine, and assign the identity to the virtual machine. Then grant permissions to the managed identity's service principal.

Answer

Use a service principal with a client secret stored in Azure Key Vault, and retrieve the secret at runtime using the VM's managed identity.

Answer

Use a system-assigned managed identity, and grant permissions by adding the managed identity to an Azure AD role that has the required Microsoft Graph permissions.

Question 15

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?

Accepted Answer

Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'. Microsoft Entra Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).

Answer

Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'

Answer

Use Identity Protection's 'User risk policy' instead of Conditional Access

Answer

Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'