AZ-500 Manage identity and access — Timed 10 Questions

Question 1

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

The PIM policy has not been activated for the Global Administrator role. Microsoft Entra PIM explicitly prevents users from approving their own activation requests, even if they are members of the approver group. The scenario describes immediate activation with no approval request being sent, which indicates that the approval requirement is not being enforced. The most likely cause is that the PIM approval policy has not been activated for the Global Administrator role, so no approval workflow is triggered.

Answer

The activation approval requirement is not supported for the Global Administrator role

Answer

The user is a member of the approver group and is self-approving the request

Answer

The role activation duration is set to zero, causing immediate activation

Question 2

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

Require approval to activate.. Microsoft Entra PIM requires the 'Require approval to activate' setting to enforce that activation requests for a role must be approved by designated approvers before the role becomes active. This setting also automatically triggers email notifications to the configured approvers when a request is submitted, fulfilling both the approval and notification requirements.

Answer

Set the activation maximum duration to 1 hour.

Answer

Require justification on activation.

Answer

Configure notification emails for role activation.

Question 3

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure the role settings for the Contributor role under the resource group in PIM. Microsoft Entra PIM allows role settings to be configured at the resource group scope. By editing the role settings for the Contributor role under that specific resource group, you can require justification (e.g., a ticket number) and set a maximum activation duration (e.g., 4 hours). These settings apply only when users activate the role for that resource group via PIM.

Answer

Create a Conditional Access policy for the Privileged Role Administrator role

Answer

Use Azure AD access reviews to review active role assignments

Answer

Modify the Azure AD tenant-wide role activation settings

Question 4

A company uses Azure AD with Premium P2 licenses. They want to require that all new users register for Azure Multi-Factor Authentication (MFA) within 14 days of their first sign-in. If they do not register, they should be denied access to all cloud applications until registration is completed. Which Azure AD feature should they configure?

Accepted Answer

Conditional Access policy targeting the MFA registration. The requirement to enforce MFA registration within a specific time frame and block access until registration is complete is achieved by configuring a Conditional Access policy targeting the 'Register security information' (MFA registration) user action. This policy can require users to register for MFA and, if not completed, deny access to all cloud apps. Microsoft Entra ID P2 licenses are required for Conditional Access.

Answer

Identity Protection user risk policy

Answer

Azure AD Identity Protection sign-in risk policy

Answer

Privileged Identity Management (PIM)

Question 5

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

Require approval to activate. Microsoft Entra PIM separates the requirements for activation justification and approval. To require both, you must enable 'Require justification' (so users must type a justification) and 'Require approval to activate' (so an approver from the specified security group must approve the activation). Configuring only A omits the mandatory justification requirement.

Answer

Require multi-factor authentication

Answer

Require Azure AD join

Question 6

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that are detected as having a high sign-in risk. They have created a Conditional Access policy and assigned it to all users. Which configuration should they add to the policy to trigger the block based on the sign-in risk?

Accepted Answer

Condition: Sign-in risk: High, Grant: Block access.. Microsoft Entra ID Protection assigns a risk level (Low, Medium, High) to each sign-in based on real-time signals. A Conditional Access policy can use the 'Sign-in risk' condition to evaluate this risk level and, when set to 'High', the 'Grant' control can be configured to 'Block access', which immediately prevents the sign-in from completing. This directly meets the requirement to automatically block high-risk sign-ins.

Answer

Condition: User risk: High, Grant: Block access.

Answer

Condition: Sign-in risk: High, Grant: Require multi-factor authentication.

Answer

Condition: User risk: High, Grant: Require multi-factor authentication.

Question 7

A company uses Azure AD B2B collaboration to invite external vendors. They want to restrict the vendors to only be able to access a specific application, and prevent them from discovering other users or applications in the directory. Which configuration should they apply to the external users?

Accepted Answer

Set the 'Guest user access' level to 'Guest user access is limited to properties and memberships of directory objects'. Setting the 'Guest user access' level to 'Guest user access is limited to properties and memberships of directory objects' restricts external B2B users from enumerating the full directory, including other users and applications. This configuration ensures vendors can only access the specific application they are invited to, while preventing discovery of other directory objects, which aligns with the principle of least privilege for external identities.

Answer

Configure a Conditional Access policy targeting guest users

Answer

Enable 'External Identities' cross-tenant access settings

Answer

Assign the Application User role to the vendor users

Question 8

A company uses Azure AD. They want to ensure that all users enroll in Azure Multi-Factor Authentication (MFA) within 14 days of their first sign-in. After 14 days, any user who has not enrolled must be blocked from accessing applications. Which configuration should they implement?

Accepted Answer

Create a Conditional Access policy targeting all users and all cloud apps, with the grant control 'Require multi-factor authentication registration' and configure the grace period in the MFA registration settings.. Both B and C meet the requirement. Option B uses a Conditional Access policy with 'Require multi-factor authentication registration' and configures the MFA registration grace period to 14 days. Option C enables security defaults, which also enforce MFA registration within 14 days and block users who fail to register. Option A is incorrect because Identity Protection risk policies are for risky sign-ins only. Option D is manual, not automated.

Answer

Use Azure AD Identity Protection to create a sign-in risk policy that requires MFA registration for medium and above risks.

Answer

Configure the Azure AD audit logs to send an alert when a user has not registered for MFA after 14 days, then manually block them.

Question 9

A company uses Azure AD Identity Protection and Conditional Access. They want to automatically block user access to cloud applications when Identity Protection detects that a user's sign-in risk level is high. Which configuration should they use in a Conditional Access policy?

Accepted Answer

Include 'Sign-in risk' level 'High' and set Grant to 'Block access'.. Conditional Access policies can evaluate sign-in risk levels detected by Microsoft Entra ID Protection. When the sign-in risk level is 'High', setting the Grant control to 'Block access' directly prevents the user from accessing cloud applications, meeting the requirement to automatically block access based on a high sign-in risk.

Answer

Include 'User risk' level 'High' and set Grant to 'Require multi-factor authentication'.

Answer

Include 'Device platforms' 'All' and set Grant to 'Require managed device'.

Answer

Include 'Locations' 'All trusted locations' and set Grant to 'Block access'.

Question 10

A company uses Azure AD Conditional Access. They want to block sign-ins from countries where the company does not have offices. They have a list of allowed countries. Which condition should they configure in the Conditional Access policy?

Accepted Answer

Locations. The Locations condition in Microsoft Entra Conditional Access allows you to define named locations by IP address ranges or country/region. By configuring a policy with the Locations condition set to 'All trusted locations' or a specific list of allowed countries, you can block access from all other countries. This directly meets the requirement to block sign-ins from countries without company offices.

Answer

Device platforms

Answer

Client apps

Answer

Sign-in risk