AZ-500 Manage identity and access Practice Test 9 — 15 Questions

Question 1

You are designing an Azure RBAC role assignment strategy for a subscription. Which three of the following practices are recommended for secure role management? (Choose three.)

Accepted Answer

Use custom roles with the least privilege principle when built-in roles are too permissive. Assigning roles at the management group level reduces the number of assignments because permissions are inherited by all child subscriptions, simplifying management and reducing the risk of misconfiguration. Using custom roles with the least privilege principle ensures that users have only the permissions they need when built-in roles are too broad, minimizing the attack surface. Assigning roles to Azure AD groups rather than individual users enables centralized management of permissions through group membership, making it easier to audit and update access without modifying role assignments directly.

Answer

Create multiple role assignments for the same scope to the same user

Answer

Use the User Access Administrator role to grant users access to resources

Answer

Assign the Contributor role at the resource group level for all developers

Question 2

Your company is implementing an Azure AD B2B collaboration strategy for external partners. Which three of the following statements about Azure AD B2B collaboration are correct? (Choose three.)

Accepted Answer

Conditional Access policies can be applied to guest users. Azure AD B2B collaboration allows external users to sign in using their own Azure AD, Microsoft account (e.g., Outlook.com), or other identity providers (e.g., Google, SAML/WS-Fed IdPs). These users are represented as guest user objects in the tenant directory, which enables them to be managed like internal users. Conditional Access policies can be applied to guest users at the tenant or application level, allowing organizations to enforce MFA, device compliance, or sign-in risk policies for external collaborators.

Answer

Azure AD B2B collaboration requires an Azure AD Premium P2 license for each guest user

Answer

External users must have an Azure AD tenant in their own organization

Answer

Guest users cannot access SharePoint Online sites

Question 3

You are a security engineer for a global enterprise that uses Microsoft Entra ID (formerly Azure Active Directory). The company requires that all administrative access to Azure resources be secured using Privileged Identity Management (PIM) and that access reviews are conducted regularly. You need to implement a solution that meets the following requirements:
- Administrators must be able to activate their roles only during approved time windows.
- All role activations must require Azure AD Multi-Factor Authentication (MFA).
- Role activations must be limited to a maximum of 4 hours.
- Access reviews must be performed every 90 days for all privileged roles.
Which four of the following actions should you take to meet the requirements? (Choose four.)

Accepted Answer

In PIM settings for each privileged role, set the activation maximum duration to 4 hours.. Configuring the activation maximum duration to 4 hours in PIM settings directly enforces the requirement that role activations are limited to a maximum of 4 hours. Requiring Azure AD MFA on activation in PIM settings ensures that all role activations are protected by MFA. Configuring an access review every 90 days for privileged roles meets the access review requirement. Defining an approval workflow with a time window for activation in PIM settings allows administrators to activate roles only during approved time windows, fulfilling that specific requirement.

Answer

Create an Entra ID Conditional Access policy that requires MFA for all users when accessing Azure Resource Manager.

Answer

Configure a role-assignable group in Entra ID and add it to the privileged role.

Question 4

Match each Azure security feature to its description.

Accepted Answer

Azure Security Center: Provides unified security management and advanced threat protection across hybrid cloud workloads.. Core Azure security services: Azure Security Center (unified security management), Azure Sentinel (SIEM/SOAR), Azure Key Vault (key/secret management), Azure Firewall (network security), and Azure DDoS Protection (DDoS defense). Common confusions involve mixing up definitions, especially between Security Center and Firewall, and between Sentinel and Key Vault.

Answer

Azure Sentinel: Used to safeguard cryptographic keys and secrets used by cloud applications and services.

Answer

Azure Firewall: Provides unified security management and advanced threat protection across hybrid cloud workloads.

Question 5

Match each Azure AD authentication method to its description.

Accepted Answer

Password Hash Synchronization: Synchronizes password hashes from on-premises AD to Azure AD for authentication. Password Hash Synchronization syncs hashes; Pass-through Authentication validates on-premises; Federation (AD FS) uses on-premises federation service; Azure AD Seamless SSO provides silent sign-on. Common confusions involve swapping PHS and PTA definitions.

Answer

Password Hash Synchronization: Validates passwords directly against on-premises Active Directory without storing hashes in the cloud

Answer

Pass-through Authentication: Synchronizes password hashes from on-premises AD to Azure AD for authentication

Question 6

Match each Azure Security Center tier to its capabilities.

Accepted Answer

Free: Basic security policies and recommendations. Azure Security Center offers two tiers: Free (basic assessment and recommendations) and Standard/Azure Defender (advanced threat protection, alerts, and just-in-time access). Common confusions involve swapping the capabilities of each tier.

Answer

Free: Advanced threat detection and response

Answer

Standard (Azure Defender): Basic security policies and recommendations

Question 7

Match each Azure AD Conditional Access component to its role.

Accepted Answer

User and group assignments: Specify the users and groups that the policy applies to.. In Azure AD Conditional Access, User and group assignments target identities, Cloud app assignments target apps, and Conditions define environmental signals. Grant controls enforce actions like MFA. Common confusions involve mixing these roles.

Answer

User and group assignments: Define conditions such as location and device state.

Answer

Cloud app assignments: Enforce access controls like requiring multi-factor authentication.

Answer

Grant controls: Specify the cloud applications that the policy applies to.

Question 8

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?

Accepted Answer

Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'. Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).

Answer

Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'

Answer

Use Identity Protection's 'User risk policy' instead of Conditional Access

Answer

Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'

Question 9

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

Accepted Answer

In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.. Azure AD PIM can integrate with Conditional Access via authentication context. By enabling 'Require Azure AD Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Answer

Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

Answer

In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

Answer

Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

Question 10

A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?

Accepted Answer

Azure AD Application Proxy.. Azure AD Application Proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Azure AD, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.

Answer

Azure AD B2C (Business-to-Consumer).

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Front Door.

Question 11

A company uses Azure AD Identity Protection and Conditional Access. A user is detected with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user, but only when the sign-in originates from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy targeting all users. Which configuration should they add to the policy to achieve this?

Accepted Answer

Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.. It combines a condition for 'User risk' set to 'High' with an exclusion of 'All trusted locations' under the 'Locations' condition, then grants 'Block access'. This ensures that the block only applies when the sign-in originates from an untrusted location, meeting the requirement to automatically block sign-ins for high-risk users only from locations not in the company's trusted IP list.

Answer

Add a condition for 'User risk' set to 'High', and a condition for 'Sign-in risk' set to 'High', then grant 'Block access'.

Answer

Add a condition for 'User risk' set to 'High', and under 'Grant', select 'Require multi-factor authentication' and 'Block access'.

Answer

Add a condition for 'Locations' set to 'Any location' and under 'Grant', select 'Block access' for all users.

Question 12

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. The security policy requires that when a user activates the Security Administrator role, they must: 1) Provide a justification, 2) Get approval from a designated security group, and 3) The activation must last a maximum of 4 hours. Which combination of PIM settings should they configure?

Accepted Answer

Enable 'Require justification', 'Require approval', and set 'Maximum activation duration' to 4 hours. Assign the security group as the approver.. Azure AD PIM allows you to enforce all three requirements: justification, approval from a specified security group, and a maximum activation duration. By enabling 'Require justification' and 'Require approval' and setting the 'Maximum activation duration' to 4 hours, you meet the security policy exactly. The approval step requires assigning a designated security group as the approver, which is supported in PIM role settings.

Answer

Enable 'Require justification', 'Require ticket information', and set 'Maximum activation duration' to 8 hours.

Answer

Enable 'Require approval' and set 'Maximum activation duration' to 4 hours. Do not require justification.

Answer

Enable 'Require Azure MFA on activation', 'Require justification', and set 'Maximum activation duration' to 4 hours.

Question 13

A company uses Azure AD Privileged Identity Management (PIM) to manage access to critical roles. They want to require that users who are eligible for the 'Security Administrator' role must provide a support ticket number in the justification when activating the role. Additionally, they want to set a maximum activation duration of 4 hours. Which PIM role setting should they configure?

Accepted Answer

Activation settings. The 'Activation settings' in Azure AD PIM allow you to configure the maximum activation duration (in hours) and require justification, including a support ticket number, when a user activates an eligible role. These settings directly control the conditions under which role activation occurs, such as duration and mandatory justification fields.

Answer

Notification settings

Answer

Approval settings

Answer

Assignment settings

Question 14

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Global Administrator' role. The security team wants to ensure that when a user activates the role, they must provide a justification, and the activation request must be approved by a specific group of security administrators. They have already configured the role for activation with a maximum duration of 8 hours. Which additional PIM settings should they configure?

Accepted Answer

Enable 'Require approval to activate' and select the security group as approver. The scenario requires both justification and approval for role activation. PIM allows you to enforce 'Require justification on activation' and 'Require approval to activate' as separate settings. By enabling 'Require approval to activate' and selecting the security group as the approver, you meet the requirement for approval. Justification is already a default requirement in PIM when approval is enabled, but you must also explicitly set 'Require justification on activation' to 'On' if not already enforced; however, the question states they have already configured the role for activation with a maximum duration, so the missing piece is the approval configuration.

Answer

Set 'Require Azure Multi-Factor Authentication' to 'On'

Answer

Set 'Require justification on activation' to 'On' and also enable 'Require ticket information'

Answer

Create a separate PIM request workflow using Azure Logic Apps

Question 15

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They have configured the role activation to require Azure Multi-Factor Authentication and a support ticket number. However, users are reporting that they can activate the role without entering a ticket number. What is the most likely cause?

Accepted Answer

The 'Require ticket information on activation' setting is not enabled in the role settings. The 'Require ticket information on activation' setting is a separate toggle in the PIM role settings that must be explicitly enabled. Even if the support ticket number field is displayed in the activation form, the system will not enforce its entry unless this specific setting is turned on. Without it, users can leave the field blank and still successfully activate the role.

Answer

Users are activating through the Azure AD overview page instead of the PIM blade

Answer

The activation policy requires approval but the approvers ignore the ticket field

Answer

The role is configured for 'Active' assignment instead of 'Eligible'