AZ-500 Manage identity and access — Timed 10 Questions

Question 1

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

10 minute time limit — choose an answer to begin.

Accepted Answer

Set the activation maximum duration to 8 hours.. Setting the activation maximum duration to 8 hours enforces the time-bound requirement, ensuring that once a user activates the Global Administrator role, the activation automatically expires after 8 hours. Option B is correct because enabling the approval workflow and adding the manager as an approver ensures that the manager must approve each activation request, meeting the requirement for manager approval. Together, these two configurations satisfy both the time-bound and approval constraints.

Answer

Require multi-factor authentication on activation.

Answer

Require justification on activation.

Question 2

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

10 minute time limit — choose an answer to begin.

Accepted Answer

The PIM policy has not been activated for the Global Administrator role. Azure AD PIM explicitly prevents users from approving their own activation requests, even if they are members of the approver group. The scenario describes immediate activation with no approval request being sent, which indicates that the approval requirement is not being enforced. The most likely cause is that the PIM approval policy has not been activated for the Global Administrator role, so no approval workflow is triggered.

Answer

The activation approval requirement is not supported for the Global Administrator role

Answer

The user is a member of the approver group and is self-approving the request

Answer

The role activation duration is set to zero, causing immediate activation

Question 3

A company has a partner organization in another Azure AD tenant. They want to allow users from the partner tenant to access their Azure resources through Azure AD B2B collaboration. They also want the partner's Multi-Factor Authentication (MFA) claims to be trusted when partner users access their resources, so that they do not need to perform MFA again. Which configuration in cross-tenant access settings should they enable?

Accepted Answer

Trust multi-factor authentication from the partner tenant (inbound trust).. Cross-tenant access settings in Azure AD allow you to configure inbound trust for MFA from an external Azure AD tenant. When enabled, Azure AD B2B collaboration will accept the partner tenant's MFA claims, so partner users who have already satisfied MFA in their home tenant will not be prompted again when accessing your resources. This is configured under 'Cross-tenant access settings' > 'Inbound trust settings' for the specific partner tenant.

Answer

Trust device compliance from the partner tenant.

Answer

Enable a Conditional Access policy that grants access to the partner tenant.

Answer

Configure identity synchronization with the partner tenant.

Question 4

A company has Azure AD Conditional Access policies that require multi-factor authentication (MFA) for all users accessing sensitive cloud apps. The security team wants to extend this protection by monitoring and controlling user activities within those applications (e.g., preventing data exfiltration during a session). Which Conditional Access session control should they implement?

Accepted Answer

Session control: Conditional Access Application Control. Conditional Access Application Control (also known as Microsoft Defender for Cloud Apps session control) allows real-time monitoring and control of user activities within cloud apps, such as blocking downloads or preventing data exfiltration. This session control works by redirecting user traffic through Microsoft Defender for Cloud Apps as a reverse proxy, enabling granular policy enforcement during the session. The requirement specifically asks for monitoring and controlling activities inside the app, which goes beyond just requiring MFA at sign-in.

Answer

Grant control: Require MFA

Answer

Session control: Use app enforced restrictions

Answer

Session control: Sign-in frequency

Question 5

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

10 minute time limit — choose an answer to begin.

Accepted Answer

Require approval to activate.. Azure AD PIM requires the 'Require approval to activate' setting to enforce that activation requests for a role must be approved by designated approvers before the role becomes active. This setting also automatically triggers email notifications to the configured approvers when a request is submitted, fulfilling both the approval and notification requirements.

Answer

Set the activation maximum duration to 1 hour.

Answer

Require justification on activation.

Answer

Configure notification emails for role activation.

Question 6

A company manages Azure AD roles with Privileged Identity Management (PIM). They want to enforce that when a user activates the Global Administrator role, they must provide a justification and also use Multi-Factor Authentication. Which PIM settings should they configure? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication on activation.. PIM allows you to enforce Multi-Factor Authentication (MFA) as a mandatory step during role activation, ensuring the user's identity is verified beyond just a password. Option C is correct because PIM's 'Require justification on activation' setting forces the user to provide a business reason for activating the Global Administrator role, which is a common compliance requirement. Together, these two settings satisfy the requirement for both MFA and justification during activation.

Answer

Require approval on activation.

Answer

Extend activation duration.

Question 7

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

10 minute time limit — choose an answer to begin.

Accepted Answer

Enable 'Require approval' and set 'Approvers' to the designated group. Also, enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours.. The scenario requires both approval and ticket-based justification. In Azure AD PIM, 'Require approval' enforces that a designated approver group must approve the activation, while 'Require ticket information on activation' ensures the user provides a ticket number as justification. Setting 'Activation maximum duration' to 4 hours limits the role activation time. These three settings together satisfy all requirements.

Answer

Enable 'Require approval' for the role and set 'Approvers' to the designated group. Also, set 'Activation maximum duration' to 4 hours.

Answer

Enable 'Require justification on activation' and set 'Activation maximum duration' to 4 hours. No approval configuration is needed.

Answer

Enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours. Approval is not required because the ticket number serves as justification.

Question 8

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

10 minute time limit — choose an answer to begin.

Accepted Answer

Set the activation maximum duration to 4 hours and require approval from the 'Global Admin Approvers' group.. Azure AD PIM allows you to configure role activation settings, including an activation maximum duration (which can be set to 4 hours) and requiring approval from a specified group (in this case, 'Global Admin Approvers'). These settings directly meet the requirement for time-bound activation with approval.

Answer

Set the activation maximum duration to 4 hours and enable MFA on activation.

Answer

Set the activation to require a ticket number justification and set the maximum duration to 8 hours.

Answer

Set the role to be permanently active but with a just-in-time approval workflow.

Question 9

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

10 minute time limit — choose an answer to begin.

Accepted Answer

Assign the user as 'Eligible' for the role.. In Azure AD Privileged Identity Management (PIM), an 'Eligible' assignment means the user does not have permanent access to the role. They must activate the role on-demand through a time-bound activation process, which may require approval and multi-factor authentication. This directly meets the requirement of having no standing access, as the role is inactive until the user explicitly activates it.

Answer

Assign the user as 'Active' for the role.

Answer

Assign the user as 'Permanent' for the role.

Answer

Add the user as a 'Guest' in the directory.

Question 10

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure the role settings for the Contributor role under the resource group in PIM. Azure AD PIM allows role settings to be configured at the resource group scope. By editing the role settings for the Contributor role under that specific resource group, you can require justification (e.g., a ticket number) and set a maximum activation duration (e.g., 4 hours). These settings apply only when users activate the role for that resource group via PIM.

Answer

Create a Conditional Access policy for the Privileged Role Administrator role

Answer

Use Azure AD access reviews to review active role assignments

Answer

Modify the Azure AD tenant-wide role activation settings