AZ-500 Manage identity and access Practice Test 5 — 15 Questions

Question 1

A company uses Azure AD B2B collaboration to invite external partner users. The security policy requires that guest users who have not signed in for more than 90 days should have their access automatically reviewed and, if not approved, removed. The company has Azure AD Premium P2 licenses. Which Azure AD feature should they configure to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Azure AD Access Review that reviews guest user access and automatically removes access after 90 days of inactivity.. Microsoft Entra ID Access Reviews, available with Microsoft Entra ID P2 licenses, allow you to create recurring reviews that specifically target guest users who have not signed in for a specified period (e.g., 90 days). The review can be configured to automatically remove access if the reviewer does not approve, directly meeting the requirement for automatic review and removal after 90 days of inactivity.

Answer

Enable automatic user deletion in the Azure AD B2B collaboration settings.

Answer

Create a Conditional Access policy that blocks sign-ins for guest users who haven't authenticated in 90 days.

Answer

Use Azure AD Identity Protection to detect guest user sign-in anomalies and revoke sessions.

Question 2

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They want to ensure that when a user activates the role, the activation request must be approved by a member of the 'Global Admin Approvers' group, and the activation should be time-bound with a maximum of 4 hours. Which PIM settings should they configure?

Accepted Answer

Set the activation maximum duration to 4 hours and require approval from the 'Global Admin Approvers' group.. Microsoft Entra PIM allows you to configure role activation settings, including an activation maximum duration (which can be set to 4 hours) and requiring approval from a specified group (in this case, 'Global Admin Approvers'). These settings directly meet the requirement for time-bound activation with approval.

Answer

Set the activation maximum duration to 4 hours and enable MFA on activation.

Answer

Set the activation to require a ticket number justification and set the maximum duration to 8 hours.

Answer

Set the role to be permanently active but with a just-in-time approval workflow.

Question 3

A company has Azure AD Identity Protection enabled. The security team wants to automatically block sign-ins that are detected as coming from a known malicious IP address. They have created a Conditional Access policy and assigned it to all users. Which configuration should they add to the policy to trigger the block based on Identity Protection risk?

Accepted Answer

Add a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access'.. Identity Protection detects sign-ins from known malicious IP addresses and assigns a 'Sign-in risk' level (e.g., High). By adding a condition for 'Sign-in risk' set to 'High' and a grant control of 'Block access', the Conditional Access policy will automatically block those sign-ins. This directly uses Identity Protection's risk detection to enforce the block without needing to manually maintain IP address lists.

Answer

Add a condition for 'Locations' and specify the known malicious IP ranges as 'Blocked locations'.

Answer

Add a condition for 'User risk' set to 'High' and a grant control of 'Require multi-factor authentication'.

Answer

Add a condition for 'Device state' set to 'Not compliant' and a grant control of 'Block access'.

Question 4

A company uses Azure AD Privileged Identity Management (PIM) to manage access to the 'Security Administrator' role. They want a specific user to be able to activate the role only when needed, rather than having standing access. The user should not have the role active at all times. Which type of assignment should they configure for this user in PIM?

Accepted Answer

Assign the user as 'Eligible' for the role.. In Microsoft Entra Privileged Identity Management (PIM), an 'Eligible' assignment means the user does not have permanent access to the role. They must activate the role on-demand through a time-bound activation process, which may require approval and multi-factor authentication. This directly meets the requirement of having no standing access, as the role is inactive until the user explicitly activates it.

Answer

Assign the user as 'Active' for the role.

Answer

Assign the user as 'Permanent' for the role.

Answer

Add the user as a 'Guest' in the directory.

Question 5

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that when a user activates this role, they must provide a support ticket number and a brief justification. Additionally, the activation should have a maximum duration of 4 hours. Which PIM role setting should they configure?

Accepted Answer

Require justification on activation. The 'Require justification on activation' setting in Microsoft Entra PIM allows you to mandate that users provide a support ticket number and a brief justification when activating a role. This setting enforces the collection of business-specific details during activation, which aligns with the requirement. The maximum activation duration of 4 hours is configured separately via the 'Activation maximum duration' setting, not through justification.

Answer

Require approval

Answer

Require MFA

Answer

Require Azure AD Identity Protection

Question 6

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want users who activate this role to provide a justification and a support ticket number, and they want the activation to expire after a maximum of 4 hours. Which PIM role settings should they configure?

Accepted Answer

Configure the activation maximum duration, require justification, and require ticket information in the role settings. The scenario requires all three conditions: a maximum activation duration of 4 hours, mandatory justification, and mandatory ticket information. In Microsoft Entra PIM, these are independent settings within the role settings configuration, and all must be enabled to meet the stated requirements. Without configuring all three, the activation would not enforce the specified controls.

Answer

Configure the activation maximum duration only

Answer

Configure the requirement for justification only

Answer

Configure the requirement for ticket information only

Question 7

A company wants to ensure that users can only access Microsoft 365 services (e.g., Exchange Online, SharePoint Online) from devices that are confirmed to be compliant with corporate security policies (e.g., encryption enabled, antivirus active). Which Azure AD policy type should they create?

Accepted Answer

Conditional Access policy with the 'Require compliant device' grant control.. A is correct because a Conditional Access policy with the 'Require compliant device' grant control enforces device-based access restrictions by checking the device's compliance status reported by Microsoft Intune. This ensures that only devices meeting corporate security policies (e.g., encryption enabled, antivirus active) can access Microsoft 365 services like Exchange Online and SharePoint Online.

Answer

Identity Protection policy with a sign-in risk policy.

Answer

Access review policy for groups.

Answer

Privileged Identity Management (PIM) activation policy.

Question 8

A company has a subscription with Azure Active Directory (Azure AD). They want to enable a conditional access policy that requires all users to use multi-factor authentication (MFA) when accessing the Azure portal. The policy should only apply to users who are members of a group called 'AllUsers'. Which assignment should they configure in the policy?

Accepted Answer

Assign the 'AllUsers' group to the 'Users' section and select 'Azure portal' as the cloud app. In an Microsoft Entra Conditional Access policy, the 'Users' section is where you specify which users or groups the policy applies to, and the 'Cloud apps' section is where you select the target application (Azure portal). By assigning the 'AllUsers' group to 'Users' and selecting 'Azure portal' as the cloud app, the policy enforces MFA for all members of that group when they access the Azure portal.

Answer

Assign the 'AllUsers' group to the 'Cloud apps' section and select 'Azure portal' as the application

Answer

Add a condition for 'Client apps' specifying 'Browser' only

Answer

Create two policies: one for users and one for the Azure portal

Question 9

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that activation of this role must be approved by a designated group of security engineers before it becomes active. Which PIM role setting should they configure?

Accepted Answer

Require approval. Microsoft Entra PIM's 'Require approval' setting enforces that a designated group of approvers must authorize each activation request before the role becomes active. This directly meets the requirement for approval by security engineers, ensuring that role activation is gated by explicit consent rather than being automatic.

Answer

Activation maximum duration (hours)

Answer

MFA on activation

Answer

Require justification on activation

Question 10

A company uses Azure Active Directory and has guest users invited via B2B collaboration. The security team wants to require that all guest users from specific external organizations must complete multi-factor authentication (MFA) when accessing the company's SaaS applications. Which Conditional Access policy configuration should they use?

Accepted Answer

Create a policy that applies to 'Guest or external users' with a condition for 'External tenants' specifying the organizations, and a grant control of 'Require multi-factor authentication'.. It uses the 'External tenants' condition within a Conditional Access policy targeting 'Guest or external users' to specify the exact organizations from which guests must complete MFA. This directly meets the requirement to scope MFA enforcement to specific external organizations, not all guests. The 'Require multi-factor authentication' grant control ensures MFA is enforced for those guests when accessing SaaS applications.

Answer

Create a policy that applies to 'All users' with a condition for 'Guest or external users' and a grant control of 'Require multi-factor authentication'.

Answer

Create a policy that applies to 'All guest users' and assign it to the SaaS applications. Use a session control 'Use app enforced restrictions'.

Answer

Create a policy that applies to 'Guest or external users' with a condition for 'Sign-in risk' set to 'Medium and above' and a grant control of 'Block access'.

Question 11

A company uses Azure AD Conditional Access. They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but only when the sign-in risk level is medium or above. Which configuration should they use in the Conditional Access policy?

Accepted Answer

Assignments > Cloud apps > Include > Microsoft Azure Management, Conditions > Sign-in risk > Medium and above, Grant > Require MFA.. It specifically targets the Azure portal via 'Microsoft Azure Management' in Cloud apps, sets the sign-in risk condition to 'Medium and above', and requires MFA. This matches the requirement exactly: MFA is triggered only when accessing the Azure portal and the sign-in risk level is medium or higher.

Answer

Assignments > Users > All users, Cloud apps > All cloud apps, Conditions > User risk > Medium, Grant > Require MFA.

Answer

Assignments > Conditions > Locations > All trusted locations, Grant > Require MFA.

Answer

Assignments > Cloud apps > Include > All cloud apps, Conditions > Device platforms > iOS, Grant > Require MFA.

Question 12

A company uses Azure AD Privileged Identity Management (PIM) for the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a justification, and the activation requires approval from a designated security group. Which PIM role settings should they configure?

Accepted Answer

Require justification on activation (Yes), Require approval (Yes), Select approver(s) (the security group).. PIM role settings allow administrators to enforce both justification and approval workflows for role activation. Setting 'Require justification on activation' to 'Yes' ensures the user provides a reason, and setting 'Require approval' to 'Yes' with the designated security group as the approver enforces the approval requirement. This combination directly meets the company's stated requirements.

Answer

Require justification on activation (No), Require approval (Yes), Select approver(s) (the security group).

Answer

Expiration > Maximum activation duration (4 hours).

Answer

On activation, require Azure MFA registration.

Question 13

A company wants to allow external business partners to access specific SharePoint Online sites using their own corporate credentials. They do not want to manage partner accounts in their own Azure AD tenant. Which Azure AD feature should they use?

Accepted Answer

Azure AD External Identities. Microsoft Entra ID External Identities (specifically B2B collaboration) allows you to invite external business partners to access your SharePoint Online sites using their own corporate credentials (their home Microsoft Entra ID or identity provider). This eliminates the need to manage partner accounts in your tenant, as identities remain in their home directory and are authenticated via federation or SAML/WS-Fed protocols.

Answer

Azure AD B2C

Answer

Conditional Access

Answer

Privileged Identity Management

Question 14

A company uses Azure Active Directory (Azure AD) and wants to regularly review the membership of a group that grants access to a critical application. Each member must attest their continued need for access. Which Azure AD feature should they use?

Accepted Answer

Azure AD Identity Governance access reviews. Microsoft Entra ID Identity Governance access reviews enable administrators to create recurring reviews of group memberships, requiring each member to attest their continued need for access. This directly addresses the requirement for regular attestation of group membership for a critical application, as it automates the review process and ensures compliance.

Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD Conditional Access

Answer

Azure AD Identity Protection

Question 15

A company has Azure AD with Premium P2 licenses. They want to enforce Azure Multi-Factor Authentication (MFA) for all users accessing the Azure portal from untrusted networks, but only after the user has successfully entered their password. Which Conditional Access grant control should they configure?

Accepted Answer

Require multi-factor authentication. The 'Require multi-factor authentication' grant control in Conditional Access enforces MFA after password authentication, which aligns with the requirement to prompt for MFA only after the user has successfully entered their password. This control is applied based on the condition of 'untrusted networks' (e.g., using the 'Locations' condition to target all locations except trusted IPs), ensuring that MFA is triggered specifically for Azure portal access from untrusted networks.

Answer

Require device to be marked as compliant

Answer

Require approved client app

Answer

Require domain join