AZ-500 Manage identity and access Practice Test 8 — 15 Questions

Question 1

A compliance team wants evidence that Azure resources are evaluated against the Microsoft Cloud Security Benchmark. Which Defender for Cloud area should they use?

Accepted Answer

Regulatory compliance and security policy assignments. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides continuous monitoring of Azure resources against the Microsoft Cloud Security Benchmark (MCSB). It maps built-in policy assignments to compliance controls, generates a compliance score, and offers remediation steps. This is the designated area for evidence of MCSB evaluation.

Answer

Microsoft Entra app consent settings

Answer

Azure Firewall DNAT rules

Answer

Log Analytics saved searches only

Question 2

A security engineer wants Defender for Cloud to detect threats against Azure SQL Database and SQL Server on Azure VMs. Which plan should be enabled?

Accepted Answer

Defender for Databases or Defender for SQL coverage as presented in the portal. Defender for Databases (or the Defender for SQL coverage option in the portal) is the correct plan because it provides threat detection specifically for Azure SQL Database and SQL Server on Azure VMs. This plan monitors anomalous activities such as SQL injection, brute-force attacks, and unusual access patterns using Microsoft's threat intelligence and machine learning models. It is the only plan that directly covers both PaaS and IaaS SQL workloads as described.

Answer

Defender for Storage

Answer

Defender for App Service only

Answer

Defender External Attack Surface Management

Question 3

A Sentinel rule using a threat intelligence table fires on stale indicators that expired last week. What should be added to the query?

Accepted Answer

A filter for active indicators whose expiration time is in the future. The rule fires on stale indicators because the query lacks a filter to exclude expired threat intelligence entries. Adding a filter for active indicators whose expiration time is in the future ensures that only current, valid indicators trigger the rule, preventing false positives from outdated data.

Answer

A union with Usage

Answer

A sort by Description

Answer

A project-away of ConfidenceScore

Question 4

An application hosted on an Azure VM needs to read secrets from Key Vault without storing credentials. Which identity pattern should be used?

Accepted Answer

System-assigned managed identity with Key Vault access granted by RBAC or access policy. A system-assigned managed identity enables an Azure VM to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically creates a service principal for the VM in Azure AD, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to Key Vault. Access to secrets is then controlled by assigning RBAC roles (e.g., Key Vault Secrets User) or configuring a Key Vault access policy for that identity, eliminating the need for any stored secrets.

Answer

Client secret stored in appsettings.json

Answer

Shared access signature stored as an environment variable

Answer

A user account excluded from MFA

Question 5

An enterprise app requests tenant-wide admin consent for Microsoft Graph permissions. Security wants to prevent unreviewed user consent while allowing approved apps. Which two controls help meet this requirement?

Accepted Answer

Configure admin consent workflow. The admin consent workflow allows users to request admin approval for apps they want to consent to, ensuring that no unreviewed user consent is granted while still enabling approved apps. This workflow routes consent requests to designated administrators for review, meeting the security requirement of preventing unreviewed user consent.

Answer

Allow all users to grant consent to any app

Answer

Disable service principals globally

Question 6

A privileged administrator should activate the Security Administrator role only for approved work and for a limited time. What should be configured?

Accepted Answer

Eligible assignment with activation controls in Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure eligible assignments for roles like Security Administrator. This means the user must activate the role on demand, with time-bound activation controls (e.g., maximum activation duration, approval, MFA), ensuring the role is used only for approved work and for a limited time. This directly meets the requirement of just-in-time (JIT) access and temporary activation.

Answer

Permanent active assignment in Microsoft Entra ID

Answer

Owner role at the subscription root

Answer

Conditional Access session persistence

Question 7

A Conditional Access policy requiring compliant devices does not apply to Azure PowerShell access. Sign-in logs show the cloud app is excluded. What should be changed?

Accepted Answer

Include the relevant cloud app or target all cloud apps after testing exclusions. Conditional Access policies apply only to cloud apps explicitly included in the policy. Since Azure PowerShell is excluded, the policy does not enforce the 'Require device to be marked as compliant' condition for that app. To fix this, you must either include the specific cloud app (Microsoft Azure PowerShell) or set the policy to target 'All cloud apps' and then test exclusions to ensure the compliant device requirement is applied to Azure PowerShell access.

Answer

Disable device compliance in Intune

Answer

Convert the policy to a named location policy

Answer

Remove MFA from all users

Question 8

A Conditional Access policy should reduce account takeover risk for administrators without blocking normal low-risk access. Which two signals or controls are most appropriate?

Accepted Answer

Require phishing-resistant MFA or strong authentication for privileged roles. Requiring phishing-resistant MFA (e.g., FIDO2 security keys or certificate-based authentication) for privileged roles directly mitigates account takeover by preventing credential theft and replay attacks. This aligns with the principle of using strong authentication for high-value accounts, as specified in Microsoft's Conditional Access guidance for administrators.

Answer

Allow legacy authentication for administrator accounts

Answer

Exclude all Global Administrators from the policy

Question 9

A managed identity is used by an Azure Function to access Key Vault. Which two configurations are required?

Accepted Answer

A system-assigned or user-assigned managed identity enabled on the function app. A managed identity (either system-assigned or user-assigned) provides an Azure AD-authenticated identity for the function app, eliminating the need for credentials like client secrets. This identity is used to obtain an Azure AD access token for authenticating to Key Vault. Option D is also required because the managed identity must be granted explicit Key Vault permissions (e.g., via an access policy or RBAC role) to read secrets; without these permissions, token-based authentication will fail with a 403 Forbidden error.

Answer

A client secret stored in the function app settings

Answer

A public IP address on the function app

Question 10

A security team is reviewing risky OAuth applications in Microsoft Entra ID. Which two actions reduce future consent risk?

Accepted Answer

Restrict user consent to verified publishers and low-risk permissions. Restricting user consent to verified publishers and low-risk permissions reduces the likelihood of users approving malicious or overly permissive OAuth apps. This policy, configured in Microsoft Entra ID (Azure AD), ensures that only apps from verified publishers requesting low-risk permissions can be consented to by users, thereby mitigating consent-based attacks like OAuth consent phishing.

Answer

Grant tenant-wide admin consent to all existing apps

Answer

Delete all enterprise applications including Microsoft first-party apps

Question 11

A Sentinel detection should enrich alerts with business-critical asset context. Which two mechanisms are appropriate?

Accepted Answer

Join the query with a watchlist of critical assets. Watchlists in Microsoft Sentinel allow you to store and reference a curated set of critical asset identifiers (e.g., hostnames, IPs, account SIDs). By joining your analytics rule query with a watchlist, you can automatically enrich alerts with business-critical context, ensuring that incidents involving high-value assets are flagged with additional metadata. Option C is correct because mapping entities like Host, Account, and IP in the analytics rule definition enables Sentinel to extract and normalize these identifiers from raw log fields, which then allows playbooks, investigations, and threat intelligence to correlate alerts with asset context.

Answer

Delete low-severity incidents automatically

Answer

Disable all built-in analytics templates

Question 12

A team wants to deploy Sentinel content consistently across workspaces. Which two approaches are appropriate?

Accepted Answer

Use Content Hub solutions where available. Content Hub solutions in Azure Sentinel provide pre-packaged content (analytic rules, workbooks, playbooks) that can be installed consistently across multiple workspaces via the Azure portal or API. This ensures standardized deployment without manual errors, leveraging Microsoft's curated content for common scenarios.

Answer

Manually copy screenshots of rules

Answer

Store incidents in Azure Key Vault

Question 13

A Defender for Cloud alert indicates possible credential theft on a VM. Which two response actions are sensible early containment steps?

Accepted Answer

Isolate the affected endpoint or restrict network access if business impact allows. Isolating the affected VM or restricting its network access is a fundamental containment step that prevents the attacker from using the compromised credentials to move laterally or exfiltrate data. Option C is also correct because resetting or revoking the suspected compromised credentials directly neutralizes the stolen credentials, preventing the attacker from authenticating further. Both actions are early containment steps: network isolation limits the attack surface, while credential reset removes the attacker's access. Deleting Log Analytics workspaces or disabling Defender for Endpoint would harm visibility and are not containment actions.

Answer

Delete all Log Analytics workspaces

Answer

Disable Microsoft Defender for Endpoint onboarding

Question 14

You are configuring Azure AD Conditional Access policies for a company that uses Microsoft Intune for mobile device management. Which three of the following conditions can be used to enforce access controls in a Conditional Access policy? (Choose three.)

Accepted Answer

Device compliance status. Device compliance status is a correct condition because Conditional Access can evaluate whether a device is marked as compliant by Intune. User sign-in risk level is correct as it leverages Azure AD Identity Protection to detect anomalous sign-in behavior. Network location based on public IP address is correct because Conditional Access can restrict access to known IP ranges. Application sensitivity labels is not a condition; sensitivity labels are used with Microsoft Information Protection for document-level controls, not as a trigger for Conditional Access policies.

Answer

Azure AD role membership

Answer

Network location based on public IP address

Answer

Operating system version of the client device

Question 15

Your organization uses Azure AD Privileged Identity Management (PIM) to manage admin roles. Which three of the following are valid configurations for role activation? (Choose three.)

Accepted Answer

Set a maximum activation duration in hours. Azure AD PIM allows organizations to enforce just-in-time (JIT) access for privileged roles. Requiring Azure AD MFA during activation ensures the user's identity is verified before role elevation. Setting a maximum activation duration (e.g., 1–8 hours) limits the window of elevated privilege. Requiring approval from designated approvers adds a secondary authorization layer, preventing unauthorized or accidental role assignments.

Answer

Automatically assign the role without activation

Answer

Require a ticket number from an external ticketing system

Answer

Disable activation during weekends